I built a platform for cryptographic provenance and deepfake defense in sports media. The idea was to give athletes and rights-holders audit-verifiable trails they could use to track and challenge non-consensual synthetic media. I started with versions four through six, iterating on the core provenance logging, then released version seven.
The gitignore hardening came after I realized I had case-study source assets and provenance logs that could easily pull generated artifacts into version control. Deepfake outputs, intermediate frames, model checkpoints, any of it could end up committed if I wasn't explicit. I added patterns for common deepfake artifact extensions and directories, synthetic video outputs, and temporary processing files. I did not trust myself to catch these manually in every commit.
I filled the provenance logs with the case-study source assets to make the audit trail concrete. Each log entry chains to the previous, with hashes and timestamps. The hard part was not the cryptography, it was making sure the logs remained clean of artifacts that would compromise their credibility. A provenance log that contains synthetic media is useless for proving authenticity.
I secured the repository against accidental commits, finished the case-study integration, and shipped v7. What I did not fully anticipate was how much of the work would be janitorial, guarding the edges of the system against contamination rather than building new capabilities.