Provenance and revision-pinned citations

Provenance and revision-pinned citations are complementary ways to make digital evidence inspectable after a source changes. Provenance records how a resource came to be: the source entities, activities, people or systems, and relationships involved. A revision-pinned citation identifies the particular state that a claim relied on instead of silently following an editable “current” page. Together they help a later reader answer two different questions: what exact object was consulted? and what history or process produced it?

The distinction matters because a stable-looking link does not necessarily identify stable content, while an exact revision does not by itself establish who created it, whether it was transformed correctly, or whether its claims are true. W3C’s PROV overview defines provenance as information about entities, activities, and people involved in producing data or a thing, and says that such information can support assessments of quality, reliability, or trustworthiness; it does not say that provenance automatically supplies those judgments. ^[1]

This article focuses on digital knowledge, software artifacts, and tool-generated evidence. It is an engineering synthesis, not a universal citation standard. Legal chains of custody, archival description, and the provenance of art and antiquities have additional domain-specific requirements.

A conventional URL can name a resource whose representation changes over time. A citation to the current page can therefore resolve successfully yet show text different from what the author consulted. Link persistence and content identity are separate properties: preserving the locator without preserving or identifying the version prevents a reader from determining whether later differences are corrections, ordinary updates, or citation errors.

Version-aware systems expose different mechanisms. MediaWiki’s PermanentLink special page redirects to a URL containing the page’s revision identifier and describes the target as a permanent link to a particular revision; its user-interface “Permanent link” action similarly selects the revision being viewed. ^[6] DataCite recommends a new DOI for major versions and relations such as IsNewVersionOf and IsPreviousVersionOf, while allowing minor versions to retain a DOI with updated metadata and a Version property. A DOI alone must therefore be interpreted under the publisher’s versioning policy rather than assumed to select immutable bytes. ^[5]

Web archives offer another model. RFC 7089’s Memento framework distinguishes an Original Resource from representations of its prior states, called Mementos, and defines datetime negotiation and TimeMaps for discovering them. A capture time is useful evidence about an archived representation, but it is not necessarily the source’s publication time or proof that the archive captured every dependency. ^[7]

The W3C PROV family supplies a general model rather than a single storage format. Its core distinctions are entities, activities, and agents. An entity can be a source document, dataset, prompt-safe public input, program, or generated artifact. An activity can be an edit, extraction, build, conversion, or publication. An agent can be a person, organization, service, or software system associated with an activity. PROV-O expresses the model as an OWL 2 ontology for interchange across systems and domains. ^{[1] [2]}

A minimal evidence chain for a transformed citation might record:

source revision --used by--> extraction activity --generated--> quoted passage
       |                         |
  stable identifier       tool/version + time
       |
 attribution and retrieval context

This graph is more informative than attaching a digest to the final passage alone. The digest can support an identity comparison, but the graph records which source was selected and which activity produced the output. Conversely, a detailed activity log without stable input and output identifiers can leave later readers unable to tell whether they obtained the same objects.

Domain profiles specialize this general idea. SLSA v1.2 uses provenance for verifiable information about where, when, and how a software artifact was produced, and separates build provenance from source provenance. The profile is designed for software supply chains; applying it to a prose citation requires different fields and verification rules. ^[3]

“Revision” can refer to different boundaries, so a citation should state what is pinned.

Software Heritage illustrates why an identifier may need context. A core SWHID identifies an archived software object, while qualifiers can add an origin, path, visit, anchor, or line fragment. The documentation also distinguishes SWHIDs from URLs, even though resolvers exist. This lets a citation preserve intrinsic object identity separately from the repository context in which the object was encountered. ^[4]

A revision pin should not be inferred from an HTTP ETag without the service’s contract. RFC 9110 defines validators for representations and distinguishes strong from weak validators. Validators are useful for cache validation and conditional requests, but their generation and scope are selected by the origin server; the specification does not turn every entity tag into a permanent public identifier. ^[8]

For public, source-backed work, a proposed citation record can preserve:

1. The human-readable citation: title, responsible author or organization where known, and the ordinary canonical link.
2. The exact version selector: revision ID, version-specific DOI, SWHID, release tag plus commit, Memento URI, or another documented mechanism.
3. The cited location: section, page, table, line range, or a short quotation sufficient to check text–source integrity.
4. Retrieval context: retrieval date and, when relevant, language, representation format, or API endpoint.
5. Provenance of transformations: extraction, OCR, translation, normalization, summarization, or conversion steps, including the tool and material settings when they affect the result.
6. Integrity information: a digest and algorithm when byte-level comparison is useful, while naming exactly which bytes or structured object were hashed.
7. Known gaps: unavailable attachments, dynamic client-side data, unarchived dependencies, inaccessible prior versions, or reliance on the source’s own account.

Not every citation needs every field. The record should be proportional to the claim and the likelihood that the source changes. A short-lived status page supporting a consequential claim may deserve a capture and quotation; a standards document with an explicit dated-version URL may already provide a strong version selector.

The final citation should remain readable without requiring the provenance graph. Structured records are supporting evidence, not a substitute for explaining which source supports which claim.

A revision pin preserves the state that an author consulted, but that state can later be corrected, retracted, or superseded. Crossref describes Crossmark as a service for exposing the current status of a research output, including corrections, retractions, and updates, and notes that its status control can remain available in downloaded PDFs. A robust scholarly citation can therefore pair two deliberately different links: an exact-version identifier for reproducibility and a maintained status record for later changes. ^[9]

The maintained status link should not replace the revision pin: a mutable status record answers what is known now, while the pin answers what evidence was used then. For consequential claims, verification should inspect both, record when current status was checked, and cite a correction or retraction notice when it changes the evidentiary assessment. This is a recommended practice synthesized here, not a claim that every publishing system implements Crossmark or an equivalent service.

A bounded verification procedure is:

1. Resolve the version-specific identifier and confirm that it selects the intended title, author or publisher, and revision.
2. Compare the quoted or paraphrased claim with that exact version, not only with the current page.
3. When the source can be corrected or retracted, inspect maintained status metadata and record when it was checked.
4. Check that any digest covers the claimed object under the documented canonicalization or object model.
5. Follow the provenance links far enough to distinguish a primary source, a secondary account, and an automated transformation.
6. Read back the stored citation record or published revision and preserve its resulting identifier.
7. Report what was not checked, such as external attachments, archive completeness, or the truth of the source’s underlying claim.

This procedure complements completion verification: a tool’s successful “publish” response can be checked by reading the exact resulting revision, while the revision’s citations can be checked against the exact source states they identify. It also complements reproducible builds. Provenance records a claimed production history; an independent rebuild tests whether specified inputs and instructions recreate specified outputs. Neither should be reported as the other.

Provenance can be false, incomplete, or misattributed. NIST’s Digital Signature Standard says digital signatures are used to detect unauthorized modification and authenticate the signatory’s identity. That assurance is not supplied by signature mathematics alone: RFC 5280 describes public-key certificates as binding keys to subjects, makes path validation depend on a trust anchor and relying-party constraints, and notes that the certification authority’s identity-validation procedures materially affect the assurance placed in a certificate. A provenance verifier should therefore record the signature scheme, protected bytes, verification key, identity-binding mechanism, validation time, and relevant revocation status instead of treating “signature valid” as a complete authorship claim. ^{[10] [11]}

Even a correctly attributed signed statement cannot prove that omitted inputs do not exist or that the signer’s assertions are true. Independent corroboration and domain-specific validation remain necessary.

Exact identity is not availability. A digest or SWHID can identify an object even when no accessible resolver currently returns it. Conversely, a mutable URL can remain available while its content changes. Preservation, resolution, and identification require separate checks.

Archived pages can be partial. A captured HTML page may depend on scripts, data APIs, stylesheets, media, or authentication state that were not captured. A Memento identifies an archived state under the archive’s record; it does not guarantee a complete replay of the original application.

Version granularity can be too coarse. A release tag might identify source code but not dependencies, build environment, generated documentation, or deployed configuration. A dataset DOI might represent a collection while a claim relies on one file or row. The citation must name the boundary actually used.

Revision pins do not freeze interpretation. Terminology, external context, and the evidentiary significance of a source can change even when the bytes do not. Pinning makes the consulted evidence inspectable; it does not make the conclusion timeless.

• Content-addressed storage explains identity derived from content and the limits of digest-based naming.
• Reproducible builds tests whether specified software artifacts can be independently recreated.
• Verifying completion in tool-using agents applies exact-revision read-back to action outcomes.
• Data lineage concerns origins and transformations across data systems.
• Persistent identifiers covers identifier governance, resolution, and long-term stewardship.