5. Generation provenance

The generation object records how a model node came to exist. Every field is optional; exporters include what they have. Three tiers:

Tier 1 — descriptive (every loom can write this):

"generation": {
  "provider": "openrouter",
  "model": "anthropic/claude-sonnet-4.5",
  "parameters": { "temperature": 1.0, "maxTokens": 1024, "topP": null },
  "requestId": "gen-abc123",
  "requestedAt": "2026-07-01T12:30:03Z",
  "receivedAt": "2026-07-01T12:30:05Z",
  "latencyMs": 1830,
  "usage": { "promptTokens": 912, "completionTokens": 208, "totalTokens": 1120 },
  "completionIndex": 0
}

completionIndex disambiguates n>1 sampling (socketteer's generation.index). parameters is free-form; recognized keys mirror common sampling params.

Tier 2 — integrity (hash chain):

"contentHash": "sha256:9f2b…",
"parentHashes": ["sha256:aa31…"],
"hashAlgorithm": "sha256"

contentHash covers the node content per the exporting application's documented scheme; parentHashes are the content hashes of the primary-source parents at creation time. A verifier that knows the scheme can detect tampering anywhere upstream. Hashes are "<alg>:<hex>" strings.

Tier 3 — evidence (raw API response):

"rawResponse": {
  "bodyHash": "sha256:c04d…",
  "encoding": "gzip+base64",
  "body": "H4sIAAAA…",
  "headers": { "x-request-id": "…" }
}

bodyHash MUST be the hash of the raw response bytes before parsing or compression. body/headers MAY be omitted (hash-only) to keep files small while still committing to the evidence. Exporters SHOULD offer excluding Tier 3 entirely — raw responses can embed the full prompt.

Importers MUST preserve generation verbatim on re-export even if they cannot verify it. A relaying application MUST NOT re-sign or re-hash content it did not generate.