Behavioral Provenance Record (BPR): A Vendor-Neutral Conformance Specification for Traceable AI-Generated Software

AI-assisted software development can now generate code, tests, and specifications at scale, but it produces no machine-checkable evidence that what was generated traces back to an approved requirement and introduced no behavior of its own. The Behavioral Provenance Record (BPR) is a vendor-neutral conformance specification that closes this gap. Its atomic unit is a single provenance record describing one node — a need, a behavioral example, a scenario, a contract element, a code unit, or a test — and the upstream nodes it derives from. A set of records forms a typed traceability graph; a classic Requirements Traceability Matrix is one projection of that graph. The specification defines a set of machine-checkable invariants organized into conformance levels (L0 structural, L1 coverage, L2 bidirectional closure, L3a claim citation, L3b attested support, L3c policy-bound support) and ships with an executable reference validator. Its central rule is provenance-or-reject: a derived node that cannot cite a resolvable upstream origin is rejected. At its highest level, BPR addresses the hardest case — inventing behavior — not by attempting to prove a negative, but by making invention a structural, localized, attributable failure at the granularity of individual behavioral claims. BPR deliberately standardizes the contract, not the mechanism: id formats, authoring tools, scenario notations, the validation engine, and all governance policy remain substitutable. In one sentence: BPR does not prove that AI-generated software is correct; it proves that every observable behavior has an accountable origin — or fails the build.