Moving your own code isn’t copying.
A paste that matches code you already typed is recognized as a move. It drops out of the review queue, and stays on the record.
Every line has a history.
Provenance records how student code gets written, edit by edit, in a tamper-evident log that travels with the submission.
In use this semester at UC Berkeley
- CS 61A
- CS 61B
- CS 61C
- CS 10
- DATA C88C
2,800+ students recording their work
The finished file is the easiest part to fake.
Similarity checkers compare final submissions, and AI tools now produce final submissions on demand. What’s much harder to produce is the afternoon behind one: the false starts, the deleted lines, the test that finally passed at 11:40 p.m.
Same file. Two histories.
Both end in exactly the same bytes. Only one of them is an evening of work.
An evening of work
633 edits10 test runs0 pastes
Away, then one paste
1 edit1 test run1 paste
Identical files. Completely different records.
Two recordings of the same assignment on one clock, 20:55 to 23:41. In the first, a student types the file over the evening: 633 edits and 10 test runs, stuck for a while on longest_flat, which they delete and write again, and every test passes at 23:40. In the second, the editor sits in the background for two and a half hours, then the whole file arrives in a single 26-line paste. Both final files are identical.
Every edit is a link.
Every change, paste and save is sealed to the one before it, in one unbroken line from the first keystroke to the hand-in. Along the way the recorder signs checkpoints, like the gold link.
Change one link, and the chain says so.
Rewrite one event and its seal stops matching. So does every event after it.
Covering it up doesn’t work either.
Reseal everything after the edit and the chain looks whole again, until the signed checkpoint. That signature can’t be redone.
trails.slog
Chain verified.
Built not to accuse.
Provenance points a person at the moments worth a look. Honest work stays out of the way.
Missing evidence is never evidence.
A check that can’t run reports that it was skipped. It never reports a failure it couldn’t see.
Your course sets the rules.
Staff can weight or switch off every signal, and a course can turn some kinds of capture off before anything is recorded.
A person decides.
Every flag opens the exact moment in the replay. Nothing happens automatically.
A flag is a question, not a verdict.
Grade the work. See the process.
The replay shows where a student got stuck, what they tried, and when it clicked. Office hours can start from the actual evening, not a guess about it.
One record. Every tool.
Three editors write the same signed log. Everything downstream reads it. Every piece is open source.
Record
provcode Provenance for VS Code The original recorder. On the VS Code Marketplace. provjet Provenance for JetBrains IntelliJ, PyCharm, CLion and the rest. On the JetBrains Marketplace. provnvim Provenance for Neovim Pure Lua, no native dependencies.Hand in
The signed bundle
The log, sealed with a per-session key. One format, from every editor.
provgate
Gradescope gateway
Pulls new submissions from Gradescope into the server, on a schedule.
Check
provd
Provenance server
Ingests a cohort, verifies every chain, keeps the log and drops the source.
Review
provlens
Provenance analyzer
The cohort, the replay, and every signal. It can also run entirely in a browser,
on a single dropped file.
One folder. Nothing else.
If you did the work, the record is the best evidence you have that you did.
Recorded
- Edits and pastes in the assignment folder
- Saves, opened files and editor focus
- Commands run in the editor’s terminal
- Which editor extensions are installed
Never recorded
- Your browser, screen, camera or other projects
- Keystrokes at the system level
- Your clipboard, unless you paste into the work
- Offline. No network requests while you work.
- Yours to read. The log is plain text, on your computer until you hand it in.
- Not forever. Stored logs are deleted on a schedule your school sets.
See it for yourself.
Type something. Paste something. Click away and come back. The record writes itself alongside.
What it can’t do.
No log is impossible to forge, and our own design documents say so. Provenance makes the easy shortcuts leave marks, and the hard ones cost more than doing the work. The source is public, and the design assumes it.
“We will know if you do something obvious, and we will know enough to ask questions if you do something subtle.”
Bring Provenance
to your course.
It’s open source, and it already runs at the scale of a large intro course. Tell us about yours.