# Qemu Source Provenance

> Use as a QEMU workflow primitive to record source trees, revisions, configs, toolchains, containers, build commands, output artifacts, hashes, assumptions, and RLCR round Git checkpoints before builds or during iterative local QEMU work.

- **Type:** Skill
- **Install:** `agentstack add skill-processmission-oh-my-qemu-qemu-source-provenance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [processmission](https://agentstack.voostack.com/s/processmission)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [processmission](https://github.com/processmission)
- **Source:** https://github.com/processmission/oh-my-qemu/tree/main/.agents/skills/qemu-source-provenance
- **Website:** https://processmission.github.io/oh-my-qemu/

## Install

```sh
agentstack add skill-processmission-oh-my-qemu-qemu-source-provenance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# QEMU Source Provenance

Use this primitive whenever a QEMU task depends on external source trees or produced artifacts: Linux, U-Boot, TF-A, EDK2, Zephyr, firmware blobs, root filesystems, disk images, DTBs, modules, initramfs files, or vendor SDKs.

## Composition

1. Start from `qemu-flow-plan` for non-trivial work.
2. Write provenance to `build/agent//source-provenance.md`.
3. Record exact commands in `commands.md`.
4. Feed verified artifacts into `qemu-image-layout`, `qemu-boot-run`, or workflow skills.
5. For RLCR source changes, record the task-tree baseline before round 1 and
   append one checkpoint row after every successful round commit.

## Required Record

Use this structure:

```markdown
# Source Provenance

## Source Roots

| Component | Path/URL | Revision | Dirty state | Purpose |
| --- | --- | --- | --- | --- |

## Task Source Baseline

| Tree | Branch | Baseline revision | Initial dirty paths | Commit pathspecs |
| --- | --- | --- | --- | --- |

## RLCR Round Checkpoints

| Round | Parent | Commit | Tree | Subject | Staged paths | Verification/review | Residual dirty state |
| --- | --- | --- | --- | --- | --- | --- | --- |

## Final Series Preparation

| Patch | Source round commits | Subject | Message draft | Required evidence | Sign-offs | AI-used-for |
| --- | --- | --- | --- | --- | --- | --- |

## Configurations

| Component | Config path/name | Key options | Notes |
| --- | --- | --- | --- |

## Toolchains and Runtime

| Tool | Version | Path | Notes |
| --- | --- | --- | --- |

## Build Commands

## Output Artifacts

| Artifact | Producer | Path | Size | SHA256 | Verified by |
| --- | --- | --- | --- | --- | --- |

## Assumptions and Gaps
```

## Rules

- Do not trust filenames as provenance. Record revision, config, command, and hash.
- Record whether a source tree is dirty before using its output.
- Treat `git rev-parse HEAD` as the common baseline, not a complete description
  of a dirty source tree.
- For RLCR, record the initial branch, baseline revision, and exact dirty paths
  before source changes. Do not fold those pre-existing paths into a round
  commit.
- After each successful round commit, record its parent, commit and tree IDs,
  subject, staged path list, verification/review evidence, and residual dirty
  state. The commit ID is the reproducible source checkpoint for that round.
- For terminal final-series preparation, record the baseline-to-checkpoint
  range, proposed patch subjects, source round commits, message draft paths,
  required per-patch evidence, the DCO sign-off identity source, any distinct
  second signer source, and any drafted `AI-used-for:` scope. Final-series
  drafts are provenance records; the human performs any actual history rewrite
  and DCO signing.
- Do not commit external input trees merely because their provenance is
  recorded. Automatic round commits apply only to the task source tree and
  pathspecs approved by `qemu-flow-plan`.
- If Docker or another container is used, record the image name, digest if available, mounted paths, and command.
- Hash final artifacts consumed by QEMU, not only intermediate build directories.
- If an artifact is copied, record both source and destination paths.
- Mark missing or inferred facts as gaps instead of silently guessing.

## Useful Checks

Prefer local source truth:

```bash
git -C  rev-parse HEAD
git -C  branch --show-current
git -C  status --short
git -C  diff --cached --name-status
git -C  rev-parse HEAD^{tree}
sha256sum 
file 
```

Use project-specific version commands when available, such as `make kernelrelease`, compiler `--version`, or firmware build banners.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [processmission](https://github.com/processmission)
- **Source:** [processmission/oh-my-qemu](https://github.com/processmission/oh-my-qemu)
- **License:** MIT
- **Homepage:** https://processmission.github.io/oh-my-qemu/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-processmission-oh-my-qemu-qemu-source-provenance
- Seller: https://agentstack.voostack.com/s/processmission
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.