About ProvenanceOS
Software now decides what we drive, what we get approved for, and what news we see. We built ProvenanceOS so every team can answer one question with certainty: where did this code come from?
Mission
ProvenanceOS exists to make software origin a first-class, auditable signal for regulated engineering teams. In 2025 it became trivial to generate code with AI, but almost impossible to tell afterward which parts were AI-generated, which were copied from a public repo, and which were written by a human. For regulated industries, that opacity is a blocker. For everyone else, it's a slow-burn liability. Our mission is to close that gap with a recorded scan result a reviewer can inspect. The AI-origin score is a heuristic over a bounded sample. It is not a certificate and not a cryptographic attestation.
Current product stage — early access
ProvenanceOS is in early access. We ship honestly against a public capability registry so a qualified visitor can tell what exists today, what is rolling out, and what is planned. Public repository URL scan intake, npm and PyPI manifest extraction with OSV checks, AI-origin scoring over a bounded source sample, policy evaluation against built-in and active custom rules, and completed-scan CycloneDX export are available now.
Available now
- Scan intake (shipped)
- AI-origin detection (shipped)
- Dependency lineage mapping (npm, PyPI) (shipped)
- Policy engine (log & warn actions) (shipped)
- Completed-scan CycloneDX export (shipped)
- Private GitHub repository scanning (connected token) (shipped)
Planned
- Archive scan intake (planned)
- AI-origin attribution expansion (per-commit, per-file, model family) (planned)
- Dependency lineage expansion (Maven & additional ecosystems) (planned)
- Policy engine (block & require-review actions) (planned)
- SOC 2 compliance reports (planned)
- EU AI Act & GDPR compliance reports (planned)
- SLSA Level 3 provenance attestation (planned)
- SSO / SAML (Okta, Azure AD, Google) (planned)
- HIPAA compliance reports (planned)
- Slack, GitLab & Bitbucket integrations, and outbound webhooks (planned)
- Real-time monitoring & drift detection (planned)
- Enterprise deployment (SCIM, log streaming, single-tenant VPC) (planned)
The groups above use the same capability list as the homepage, pricing page, and changelog.
Design partner invitation
We are looking for a small number of design partners — security, engineering, GRC, and legal teams who want to shape the policy engine, the dependency-lineage output, and the compliance-report format before general availability. Design partners get direct founder access, a configured scan pipeline for their repositories, and a say in what ships next. If that is useful, create an account and tell us what you would build first.
Who operates ProvenanceOS
ProvenanceOS is a product of Developer312, a one-person software studio focused on supply-chain integrity and AI-governance tooling. Night Lite USA LLC is the contracting party and operates the ProvenanceOS service. ProvenanceOS is a Developer312 product brand. Customer data is processed under the privacy policy and terms of service.
Founder
Edward Brooks is an AV systems engineer and software builder. He designs and ships ProvenanceOS end to end — the scan intake pipeline, the dependency and vulnerability analysis, the policy model, and the public trust surface. His engineering background spans audio-visual systems integration and full-stack software, with a focus on supply-chain integrity, least-privilege data handling, and evidence-first claims. He is also the author of the Imani series.
Reach the founder directly through contact .