← c8c8 / wf1 - Provenance Inspector / Session Map With Provenance·provenance-inspector-v1-v1 · 2026-04-16 · draft

session-map-with-provenance

Provenance Inspector

Selected-object trust surface showing source roles, correlation logic, and ordered evidence beside the session map.

Skill Proof Run

wf1 · proving that bob-wire can keep topology and trust explanation on the same page.

The selected flow should answer why it exists before the user has to inspect raw implementation details.

session rt_01J4KDselected flow #f-204view surface3 contributing surfaces

Primary Canvas

ObservedSecondary fallbackSelectedAuthority winner

Observed Actor Cluster

cursor-agent

root process

tool.call.open_file

capability invocation

Selected Flow

cursor-agent -> api.openai.com

primary semantic source: `proxy`

42 requests

14:02-14:14

HTTPS

observed transport

Fallback Context

discover host label

matches after normalization

bridge file hint

supports surrounding context

Neighboring Evidence

Adjacent file touch cluster

/workspace/app/config.ts

Conflict Callout

No direct conflict on host identity.

One secondary source reported an older alias; normalization folded it into the selected flow.

Inspector Summary

What This Is

Observed outbound network flow

The session repeatedly contacted `api.openai.com` during tool planning and response generation.

Why It Matters

This is one of the dominant semantic flows in the session.

It anchors several summary statements and downstream comparisons.

Source Contributions

proxy

primary_semantic

observed

Authoritative destination host, transport family, and repeated request count.

reducer

durable_primary

derived

Collapses repeated low-level events into one session-level flow object.

discover

fallback

secondary

Confirms environment context and historic aliasing without winning destination authority.

Correlation Notes

Human Explanation

Proxy events and reducer output agree on the repeated destination host. Discover contributes environment context but does not override destination identity.

Correlation Keys

session_id · request_id window · normalized host label · adjacent file-touch timestamps

Evidence Timeline

14:02:11

proxy

First HTTPS request to api.openai.com observed from cursor-agent.

14:04:02

proxy

Burst of 8 requests during tool planning phase.

14:05:18

discover

Host alias api-east.openai.com normalized into the same semantic destination.

14:10:46

reducer

Repeated requests merged into flow #f-204.