# What should a provenance record for copied code include?

Source: https://forum.codelifter.com/posts/what-should-a-provenance-record-for-copied-code-include/
Site: CodeLifter Forum, category Code provenance
Published: 2026-10-16. Updated: 2026-10-16. Replies: 0.

## Question by CodeLifter editors (staff), 2026-10-16

Record five things beside the copied code: where it came from, who or what wrote it, its licence as an SPDX identifier, a link to the exact source with the date you copied it, and the date someone last checked it. Put the licence where tools can read it, and keep the history in your commits.

## The five fields

These five fields are the convention CodeLifter uses on its own pages, not a published standard. They answer the three questions people ask about any pasted code: who made it, may I use it, and is it still right.

| Field | What to write | Example |
| --- | --- | --- |
| Origin | Where the code came from | Forum answer, library example, assistant suggestion, your own older project, or a mix |
| Author type | Who wrote it | Human, AI-assisted or AI-generated |
| Licence | An SPDX short identifier or expression | `MIT`, `CC-BY-SA-4.0`, `CC0-1.0` |
| Sources | A link to the exact page, answer or commit, and the date you copied it | `https://example.org/answer/123`, copied 2026-10-16 |
| Last verified | The date a person last checked the code still works and still matches its source | 2026-10-16 |

Change the last verified date only when someone actually checks. Change the author type when generated code is later rewritten by hand, and say so. Keep the source link even after heavy edits; it is the evidence of where the idea came from. The CodeLifter guide to [keeping a provenance record](https://codelifter.com/provenance/provenance-record/) covers each field at more length.

## Work out the licence before you paste

The licence field is the one people get wrong, because the licence depends on where and when the code was published.

- **Stack Exchange sites.** The Stack Exchange data dump states that [all user content contributed to the network is licensed CC BY-SA 4.0](https://archive.org/details/stackexchange). Section 3(a) of the [CC BY-SA 4.0 legal code](https://creativecommons.org/licenses/by-sa/4.0/legalcode.en) asks you to identify the creator and give a URI or hyperlink to the material, and section 3(b) says an adapter's licence must be a Creative Commons licence with the same elements, a later version, or a BY-SA compatible licence. Creative Commons itself [recommends against using its licences for software](https://creativecommons.org/faq/), which is a reason to keep these snippets small and clearly marked.
- **MDN code samples.** MDN says [code samples added on or after 20 August 2010 are in the public domain under CC0](https://developer.mozilla.org/en-US/docs/MDN/Writing_guidelines/Attrib_copyright_license), and earlier samples are under MIT. It also says that since 14 December 2020 you cannot tell from the page which applies to a given sample, so record the date and pick the stricter reading if you are unsure.
- **A repository with no licence.** GitHub's documentation says that without a licence the default copyright laws apply, so [no one may reproduce, distribute, or create derivative works](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository) from the work. Being able to view and fork it on GitHub does not change that. Until the author answers, write the licence field as unknown, with the date you asked, and do not ship the code.
- **Assistant output.** Section J of GitHub's terms says GitHub does not claim ownership of your Input or Output from its AI features, and that you are responsible for deciding whether your use needs a third-party licence. The ownership question in general is covered on [who owns AI-generated code](https://codelifter.com/provenance/who-owns-ai-generated-code/).

## How to write it so tools can read it

1. **Whole file copied.** Put an SPDX tag in a comment at or near the top of the file. Annex E of the SPDX specification describes `SPDX-License-Identifier:` followed by a licence expression in a comment, and notes that the information then travels with the file. The [SPDX License List](https://spdx.org/licenses/) gives the exact identifier for each licence.
2. **A block pasted into a bigger file.** Wrap it in snippet markers. [Annex H of the SPDX specification](https://spdx.github.io/spdx-spec/v2.3.1/file-tags/) describes `SPDX-SnippetBegin` and `SPDX-SnippetEnd`; licence tags between them apply only to that snippet. The annex is informative and says a document creator may disregard file tags, so not every tool reads these, but people do. The annex's own example is a function copy-pasted from another project, with `SPDX-SnippetCopyrightText` and `SPDX-SnippetComment` lines inside the markers.
3. **The rest of the fields.** Put origin, author type, source and verified date in the same comment, in plain words.
4. **The change itself.** Add the source link to the commit message too. A [trailer](https://git-scm.com/docs/git-interpret-trailers) is a key and value at the end of the message after a blank line; if your team uses one for assistant help, record that there as well.

A pasted Stack Overflow function might then carry this, in a JavaScript file:

```js
// SPDX-SnippetBegin
// SPDX-License-Identifier: CC-BY-SA-4.0
// SPDX-SnippetCopyrightText: <answer author's display name>
// Origin: Stack Overflow answer, adapted (renamed variables, added null check)
// Author type: human
// Source: https://stackoverflow.com/a/<answer-id>, copied 2026-10-16
// Last verified: 2026-10-16
function debounce(fn, ms) { /* ... */ }
// SPDX-SnippetEnd
```

The angle-bracket parts are placeholders; fill them from the actual answer page.

## For a whole repository

If many files carry copied code, follow the [REUSE Specification 3.3](https://reuse.software/spec-3.3/). It says each covered file must have licensing information, usually an `SPDX-FileCopyrightText` line and an `SPDX-License-Identifier` line in a header, and the licence texts go in a `LICENSES/` directory at the project root. Files that cannot hold a comment, such as images, get a neighbouring `.license` file, and a `REUSE.toml` file covers directories where headers are impractical.

## What a software bill of materials does not cover

An SBOM records the packages a build contains. The NTIA's 2021 report sets seven baseline fields, from supplier name and component name to version, identifiers, dependency relationship, the author of the SBOM data and a timestamp. It rarely says that one function was adapted from a forum answer, which is the gap the five fields fill.

## Related threads

If a reviewer questions old code, the record above is what you will reach for; see [a detector flagged code written in 2019 as AI](/posts/a-detector-flagged-code-written-in-2019-as-ai-what-now/). For the commit side of the record, see [enforcing an Assisted-by trailer](/posts/how-can-a-team-enforce-an-assisted-by-trailer-on-commits/).

---
Cite as: CodeLifter Forum, "What should a provenance record for copied code include?", https://forum.codelifter.com/posts/what-should-a-provenance-record-for-copied-code-include/, accessed 2026-10-16.