Engine Provenance: Deterministic admission control over silent model substitution in LLM runtimes

Engine Provenance: Deterministic admission control over silent model substitution in LLM runtimes Every component of an agent runtime is under the operator's control except one: the model that answers. Providers version identifiers without notice, relays substitute models, gateways route to a cheaper engine, and a local server silently returns nothing when the requested model is absent. In all four cases the runtime keeps working and the operator sees only a change in behavior with no cause attached to it. The field treats this as a detection problem and solves it by probing: send crafted prompts, measure the distribution of answers, decide statistically which model is behind the endpoint. Those methods cost calls, return probabilities, and stop at a report. This work treats it as an admission-control problem. Providers already declare the model on every response. A runtime that reads that field on each real turn, compares it against an authorized family, and aborts the turn on mismatch obtains engine provenance for zero additional calls, with no false positives, and with a verdict that gates execution instead of describing it. The contribution is not the observation itself — reading a response field is trivial. It is the governance built on top of it: the separation of family from identifier, which absorbs unannounced provider versioning without going blind to it; the rule that authorization certifies what was observed and never what was selected, which is what makes acknowledgment terminate instead of looping; and the treatment of an unnameable engine as a violation rather than a pass, which is what stops "I could not read the model" from being indistinguishable from "the model is correct." The guard proper is 379 lines of Bash; the mechanism as described here spans seven files — the guard, the observer, the two callers, the failover path, the router, and the mount point in the runtime loop. It is verified by a regression bank of behavioral scenarios that calls no API, and is in production on a single-operator runtime governing three engines across two providers and one local server.