What should a provenance record for copied code include?

The five fields

These five fields are the convention CodeLifter uses on its own pages, not a published standard. They answer the three questions people ask about any pasted code: who made it, may I use it, and is it still right.

Field	What to write	Example
Origin	Where the code came from	Forum answer, library example, assistant suggestion, your own older project, or a mix
Author type	Who wrote it	Human, AI-assisted or AI-generated
Licence	An SPDX short identifier or expression	MIT, CC-BY-SA-4.0, CC0-1.0
Sources	A link to the exact page, answer or commit, and the date you copied it	https://example.org/answer/123, copied 2026-10-16
Last verified	The date a person last checked the code still works and still matches its source	2026-10-16

Change the last verified date only when someone actually checks. Change the author type when generated code is later rewritten by hand, and say so. Keep the source link even after heavy edits; it is the evidence of where the idea came from. The CodeLifter guide to keeping a provenance record covers each field at more length.

Work out the licence before you paste

The licence field is the one people get wrong, because the licence depends on where and when the code was published.

• Stack Exchange sites. The Stack Exchange data dump states that all user content contributed to the network is licensed CC BY-SA 4.0. Section 3(a) of the CC BY-SA 4.0 legal code asks you to identify the creator and give a URI or hyperlink to the material, and section 3(b) says an adapter's licence must be a Creative Commons licence with the same elements, a later version, or a BY-SA compatible licence. Creative Commons itself recommends against using its licences for software, which is a reason to keep these snippets small and clearly marked.
• MDN code samples. MDN says code samples added on or after 20 August 2010 are in the public domain under CC0, and earlier samples are under MIT. It also says that since 14 December 2020 you cannot tell from the page which applies to a given sample, so record the date and pick the stricter reading if you are unsure.
• A repository with no licence. GitHub's documentation says that without a licence the default copyright laws apply, so no one may reproduce, distribute, or create derivative works from the work. Being able to view and fork it on GitHub does not change that. Until the author answers, write the licence field as unknown, with the date you asked, and do not ship the code.
• Assistant output. Section J of GitHub's terms says GitHub does not claim ownership of your Input or Output from its AI features, and that you are responsible for deciding whether your use needs a third-party licence. The ownership question in general is covered on who owns AI-generated code.

How to write it so tools can read it

1. Whole file copied. Put an SPDX tag in a comment at or near the top of the file. Annex E of the SPDX specification describes SPDX-License-Identifier: followed by a licence expression in a comment, and notes that the information then travels with the file. The SPDX License List gives the exact identifier for each licence.
2. A block pasted into a bigger file. Wrap it in snippet markers. Annex H of the SPDX specification describes SPDX-SnippetBegin and SPDX-SnippetEnd; licence tags between them apply only to that snippet. The annex is informative and says a document creator may disregard file tags, so not every tool reads these, but people do. The annex's own example is a function copy-pasted from another project, with SPDX-SnippetCopyrightText and SPDX-SnippetComment lines inside the markers.
3. The rest of the fields. Put origin, author type, source and verified date in the same comment, in plain words.
4. The change itself. Add the source link to the commit message too. A trailer is a key and value at the end of the message after a blank line; if your team uses one for assistant help, record that there as well.

A pasted Stack Overflow function might then carry this, in a JavaScript file:

// SPDX-SnippetBegin
// SPDX-License-Identifier: CC-BY-SA-4.0
// SPDX-SnippetCopyrightText: <answer author's display name>
// Origin: Stack Overflow answer, adapted (renamed variables, added null check)
// Author type: human
// Source: https://stackoverflow.com/a/<answer-id>, copied 2026-10-16
// Last verified: 2026-10-16
function debounce(fn, ms) { /* ... */ }
// SPDX-SnippetEnd

The angle-bracket parts are placeholders; fill them from the actual answer page.

For a whole repository

If many files carry copied code, follow the REUSE Specification 3.3. It says each covered file must have licensing information, usually an SPDX-FileCopyrightText line and an SPDX-License-Identifier line in a header, and the licence texts go in a LICENSES/ directory at the project root. Files that cannot hold a comment, such as images, get a neighbouring .license file, and a REUSE.toml file covers directories where headers are impractical.

What a software bill of materials does not cover

An SBOM records the packages a build contains. The NTIA's 2021 report sets seven baseline fields, from supplier name and component name to version, identifiers, dependency relationship, the author of the SBOM data and a timestamp. It rarely says that one function was adapted from a forum answer, which is the gap the five fields fill.

Related threads

If a reviewer questions old code, the record above is what you will reach for; see a detector flagged code written in 2019 as AI. For the commit side of the record, see enforcing an Assisted-by trailer.