# PFES-ENG-002 — Firmware Provenance

**Status:** Stable principle / evolving implementation  
**Knowledge Cycle Stages:** Preserve

## Purpose

Treat provenance as part of firmware identity and engineering value.

## Engineering Problem

Identical payload bytes can arrive through different utilities, recovery paths, OEM packages, and transformations. Their engineering value may differ even when hashes match.

## Historical Engineering Evolution

Provenance began as metadata. Multiple recovery paths and packaging variants showed that provenance changes what can later be verified, reconstructed, repacked, or learned. Provenance became part of the artifact.

## Engineering Discoveries

- Provenance is part of the engineering artifact.
- Recovery method is evidence.
- Firmware identity is richer than checksums.

## Architectural Decisions

- Original vendor artifacts remain canonical.
- Preserve recovery and transformation history.
- Do not deduplicate solely by payload hash.
- Retain distinct provenance variants side by side when useful.

## Knowledge Produced

- Artifact lineage
- Recovery history
- Transformation history
- Validation history

## Knowledge Consumed

- Acquisition records
- Hashes
- Container evidence
- Historical reports

## Current Engineering State

Original utilities, recovered artifacts, and provenance variants are retained where they provide unique engineering value. Older update-utility-extracted payloads and patched variants may remain intentionally duplicated with explicit provenance.

## Engineering Lessons

- Duplicate bytes do not imply duplicate engineering value.
- Provenance enables rebuilding original utilities with modified firmware.

## Negative Knowledge

Project Frankenstein no longer assumes:

- Hashes alone define firmware identity.
- Successful extraction makes provenance unnecessary.

## Current Implementations

- Stage inventories
- Artifact naming and manifests
- Manual provenance review

## Future Implementations

- Formal provenance manifests
- Cross-repository artifact identity
- Automated confidence propagation

## Open Questions

To be expanded during engineering review.

## Why This Chapter Exists

Without provenance, the project loses both reproducibility and future engineering options.
