One immutable artifact version.
Identity is id; content is blob, an address in the workspace's content-addressed store. The two are separate on purpose: the same bytes registered twice are two versions with two histories, and a reference to a version keeps meaning the same thing after the family moves on. derived_from names the version this one was made from, which is how a provenance walk crosses generations.
