Dataset lineage / data BOM — at1 databom

Custody proves what arrived and reconciliation proves a join verdict; DATABOM proves how an output was derived. at1 databom seal runs a program on its inputs and emits a signed certificate over {input hashes, program hash, output hash, environment fingerprint}. The certificate carries the program source, so an independent party runs at1 databom verify, which re-executesthe sealed program on the sealed inputs and confirms the output reproduces byte-exact. Chain the certificates and an entire lineage — raw inputs → intermediate artifacts → final figure — is re-derivable and tamper-evident.

Use it

# seal a step: run a program on its inputs -> a signed, re-executable derivation cert
at1 databom seal stage1.py --in raw.csv --out clean.bin -o s1.cert

# an independent party RE-EXECUTES the sealed program and confirms the output hash (free)
at1 databom verify s1.cert

# compose certs into a hash-continuous pipeline DAG (one stage's output hash == the next's input hash)
at1 databom graph s1.cert s2.cert

What it proves

  • Derivation — the output really is this program applied to those exact inputs; verification re-runs it rather than trusting a stored hash.
  • Tamper-evidence — edit an input, the program, or the output and verification fails; a silent pass is structurally impossible.
  • Whole pipelines — an edge exists only where one stage's output hash equals the next stage's input hash; the graph must be acyclic and connected.

DATABOM is honest about determinism: a step that does not reproduce its own output on a second run is refused, at seal and at verify. It proves derivation — it does not claim the program is correct, nor hide it (the source is carried so it can be re-run). The AI-Act / regulated data-lineage wedge: “show me how this figure was produced, and prove it.”

Pairs with Custody Receipts (what arrived), Reconciliation (a provable join), and the AT-1 Ledger. See the DATABOM product page.

← CLI reference