data-annotations 2.5.0__tar.gz → 2.6.0__tar.gz

{data_annotations-2.5.0 → data_annotations-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: data-annotations
-Version: 2.5.0
+Version: 2.6.0
 Summary: Annotate data artifacts with provenance and descriptions
 Keywords: annotations,data,metadata,provenance,reproducibility
 Author: Rodrigo C.  G.  Pena
@@ -109,6 +109,11 @@ Every annotation document includes provenance with:
   directory content digests, and upstream annotation sidecar references when
   present
 
+Local file hashing defaults to checksum policy `auto`: existing files are hashed
+only up to `10 * 1024**3` bytes (10 GiB). Larger files are still recorded, but
+their `sha256` or directory `content_digest` is left unset unless you provide a
+precomputed checksum yourself.
+
 You can also attach your own parameters, input file paths, and function names.
 Local filesystem paths in provenance are stored as absolute paths. URI-style inputs
 such as `s3://...` or `https://...` are preserved as provided.
@@ -502,6 +507,75 @@ README.
 If you want the direct writer approach instead, use `write_file_manifest(...)` and
 `write_directory_manifest(...)` (see `examples/`).
 
+## Checksum Policy
+
+All provenance and annotation entry points that hash local files support the same
+policy controls:
+
+- `checksum_policy="auto"`: hash existing local files only when they are at or
+  below `max_checksum_bytes`. This is the default, and
+  `max_checksum_bytes` defaults to `10 * 1024**3` bytes (10 GiB).
+- `checksum_policy="always"`: hash existing local files regardless of size.
+- `checksum_policy="never"`: never hash local files automatically. Checksums are
+  recorded only when you supply them explicitly.
+
+When a checksum is skipped, JSON sidecars keep the same schema and simply store
+`sha256: null`. Directory `content_digest` is also left unset when any tracked
+member file lacks a checksum.
+
+You can change the policy from Python:
+
+```python
+from data_annotations.annotations import annotate_file
+from data_annotations.provenance import write_file_manifest
+
+write_file_manifest(
+    "outputs/summary.txt",
+    checksum_policy="always",
+)
+
+annotate_file(
+    "outputs/summary.txt",
+    title="Run Summary",
+    summary="Post-hoc summary.",
+    artifact_sha256="precomputed-sha256",
+    checksum_policy="never",
+)
+```
+
+You can also inject precomputed checksums directly:
+
+- File APIs: pass `artifact_sha256=...`.
+- File or directory APIs: pass `checksum_overrides={path: sha256}`. For
+  directory outputs, keys can be relative to the output directory or absolute
+  paths.
+- Decorators such as `record_file_manifest(...)`, `record_directory_manifest(...)`,
+  `record_file_annotation(...)`, and `record_directory_annotation(...)` accept the
+  same checksum-policy arguments.
+
+From the CLI, use `--checksum-policy`, `--max-checksum-bytes`, `--sha256`, and
+repeatable `--checksum PATH=SHA256`:
+
+```bash
+data-annotations annotate file path/to/summary.txt \
+  --title "Run Summary" \
+  --summary "Post-hoc summary." \
+  --kind report \
+  --checksum-policy never \
+  --sha256 0123456789abcdef...
+
+data-annotations annotate directory path/to/run-001 \
+  --title "Processing outputs" \
+  --summary "Directory-level outputs." \
+  --checksum-policy never \
+  --checksum processed.csv=0123456789abcdef...
+
+data-annotations provenance chain path/to/run-001 \
+  --checksum-policy always
+```
+
+For a complete runnable workflow, see `examples/checksum_policy.py`.
+
 ## Description Layer
 
 The `data_annotations.description` sub-package provides the structured description
@@ -628,6 +702,7 @@ target: path/to/participants.csv
 title: Participant Cohort
 summary: Participant-level cohort assignments.
 kind: dataset
+sha256: 0123456789abcdef...
 
 inputs:
     - ${DATA_ROOT}/raw/participants.csv
@@ -670,6 +745,9 @@ provenance:
     command: bash process_from_instrument.sh
     script: process_from_instrument.sh
 
+checksums:
+    processed.csv: 0123456789abcdef...
+
 artifacts:
     - path: processed.csv
       kind: dataset
@@ -765,6 +843,11 @@ resolving an older installed command. From a source checkout, use
 `uv run data-annotations provenance chain ...`, or reinstall the CLI from the
 updated source before using the bare `data-annotations` command.
 
+Both `match` and `chain` also accept `--checksum-policy` and
+`--max-checksum-bytes`. Use `--checksum-policy always` when you want full
+verification of large local files, and leave the default `auto` when you prefer
+to avoid long checksum passes on very large artifacts.
+
 ### Run With `uvx`
 
 ```bash
@@ -886,6 +969,7 @@ uv run python examples/record_file_description.py
 uv run python examples/record_directory_description.py
 uv run python examples/annotate_file.py
 uv run python examples/annotate_directory.py
+uv run python examples/checksum_policy.py
 uv run python examples/annotate_file_answers_cli.py
 uv run python examples/write_file_manifest.py
 uv run python examples/write_directory_manifest.py

{data_annotations-2.5.0 → data_annotations-2.6.0}/README.md

@@ -79,6 +79,11 @@ Every annotation document includes provenance with:
   directory content digests, and upstream annotation sidecar references when
   present
 
+Local file hashing defaults to checksum policy `auto`: existing files are hashed
+only up to `10 * 1024**3` bytes (10 GiB). Larger files are still recorded, but
+their `sha256` or directory `content_digest` is left unset unless you provide a
+precomputed checksum yourself.
+
 You can also attach your own parameters, input file paths, and function names.
 Local filesystem paths in provenance are stored as absolute paths. URI-style inputs
 such as `s3://...` or `https://...` are preserved as provided.
@@ -472,6 +477,75 @@ README.
 If you want the direct writer approach instead, use `write_file_manifest(...)` and
 `write_directory_manifest(...)` (see `examples/`).
 
+## Checksum Policy
+
+All provenance and annotation entry points that hash local files support the same
+policy controls:
+
+- `checksum_policy="auto"`: hash existing local files only when they are at or
+  below `max_checksum_bytes`. This is the default, and
+  `max_checksum_bytes` defaults to `10 * 1024**3` bytes (10 GiB).
+- `checksum_policy="always"`: hash existing local files regardless of size.
+- `checksum_policy="never"`: never hash local files automatically. Checksums are
+  recorded only when you supply them explicitly.
+
+When a checksum is skipped, JSON sidecars keep the same schema and simply store
+`sha256: null`. Directory `content_digest` is also left unset when any tracked
+member file lacks a checksum.
+
+You can change the policy from Python:
+
+```python
+from data_annotations.annotations import annotate_file
+from data_annotations.provenance import write_file_manifest
+
+write_file_manifest(
+    "outputs/summary.txt",
+    checksum_policy="always",
+)
+
+annotate_file(
+    "outputs/summary.txt",
+    title="Run Summary",
+    summary="Post-hoc summary.",
+    artifact_sha256="precomputed-sha256",
+    checksum_policy="never",
+)
+```
+
+You can also inject precomputed checksums directly:
+
+- File APIs: pass `artifact_sha256=...`.
+- File or directory APIs: pass `checksum_overrides={path: sha256}`. For
+  directory outputs, keys can be relative to the output directory or absolute
+  paths.
+- Decorators such as `record_file_manifest(...)`, `record_directory_manifest(...)`,
+  `record_file_annotation(...)`, and `record_directory_annotation(...)` accept the
+  same checksum-policy arguments.
+
+From the CLI, use `--checksum-policy`, `--max-checksum-bytes`, `--sha256`, and
+repeatable `--checksum PATH=SHA256`:
+
+```bash
+data-annotations annotate file path/to/summary.txt \
+  --title "Run Summary" \
+  --summary "Post-hoc summary." \
+  --kind report \
+  --checksum-policy never \
+  --sha256 0123456789abcdef...
+
+data-annotations annotate directory path/to/run-001 \
+  --title "Processing outputs" \
+  --summary "Directory-level outputs." \
+  --checksum-policy never \
+  --checksum processed.csv=0123456789abcdef...
+
+data-annotations provenance chain path/to/run-001 \
+  --checksum-policy always
+```
+
+For a complete runnable workflow, see `examples/checksum_policy.py`.
+
 ## Description Layer
 
 The `data_annotations.description` sub-package provides the structured description
@@ -598,6 +672,7 @@ target: path/to/participants.csv
 title: Participant Cohort
 summary: Participant-level cohort assignments.
 kind: dataset
+sha256: 0123456789abcdef...
 
 inputs:
     - ${DATA_ROOT}/raw/participants.csv
@@ -640,6 +715,9 @@ provenance:
     command: bash process_from_instrument.sh
     script: process_from_instrument.sh
 
+checksums:
+    processed.csv: 0123456789abcdef...
+
 artifacts:
     - path: processed.csv
       kind: dataset
@@ -735,6 +813,11 @@ resolving an older installed command. From a source checkout, use
 `uv run data-annotations provenance chain ...`, or reinstall the CLI from the
 updated source before using the bare `data-annotations` command.
 
+Both `match` and `chain` also accept `--checksum-policy` and
+`--max-checksum-bytes`. Use `--checksum-policy always` when you want full
+verification of large local files, and leave the default `auto` when you prefer
+to avoid long checksum passes on very large artifacts.
+
 ### Run With `uvx`
 
 ```bash
@@ -856,6 +939,7 @@ uv run python examples/record_file_description.py
 uv run python examples/record_directory_description.py
 uv run python examples/annotate_file.py
 uv run python examples/annotate_directory.py
+uv run python examples/checksum_policy.py
 uv run python examples/annotate_file_answers_cli.py
 uv run python examples/write_file_manifest.py
 uv run python examples/write_directory_manifest.py

{data_annotations-2.5.0 → data_annotations-2.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "data-annotations"
-version = "2.5.0"
+version = "2.6.0"
 description = "Annotate data artifacts with provenance and descriptions"
 readme = "README.md"
 authors = [

{data_annotations-2.5.0 → data_annotations-2.6.0}/src/data_annotations/_decorators.py

@@ -9,6 +9,7 @@ if TYPE_CHECKING:
         DocumentedArtifactGroup,
     )
     from data_annotations.provenance.models import ChildBundle, ProducedFile
+    from data_annotations.provenance.models import ChecksumPolicy
 
 DEFAULT_INPUT_ARGS = ("input_path", "input_paths")
 
@@ -78,6 +79,8 @@ def coerce_produced_file(
     item: Any,
     *,
     normalize_paths: bool = True,
+    checksum_policy: "ChecksumPolicy" = "auto",
+    max_checksum_bytes: int | None = None,
 ) -> "ProducedFile":
     from data_annotations.description.models import DocumentedArtifact
     from data_annotations.provenance import writers as provenance_writers
@@ -89,7 +92,15 @@ def coerce_produced_file(
             path=str(path),
             kind=item.kind,
             sha256=(
-                provenance_writers.sha256_file(path)
+                provenance_writers._resolve_file_sha256(
+                    path,
+                    checksum_policy=checksum_policy,
+                    max_checksum_bytes=(
+                        max_checksum_bytes
+                        if max_checksum_bytes is not None
+                        else provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES
+                    ),
+                )
                 if normalize_paths and path.exists()
                 else None
             ),
@@ -106,7 +117,15 @@ def coerce_produced_file(
             path=str(normalized),
             kind=kind,
             sha256=(
-                provenance_writers.sha256_file(normalized)
+                provenance_writers._resolve_file_sha256(
+                    normalized,
+                    checksum_policy=checksum_policy,
+                    max_checksum_bytes=(
+                        max_checksum_bytes
+                        if max_checksum_bytes is not None
+                        else provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES
+                    ),
+                )
                 if normalize_paths and normalized.exists()
                 else None
             ),
@@ -117,7 +136,15 @@ def coerce_produced_file(
         path=str(path),
         kind="other",
         sha256=(
-            provenance_writers.sha256_file(path)
+            provenance_writers._resolve_file_sha256(
+                path,
+                checksum_policy=checksum_policy,
+                max_checksum_bytes=(
+                    max_checksum_bytes
+                    if max_checksum_bytes is not None
+                    else provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES
+                ),
+            )
             if normalize_paths and path.exists()
             else None
         ),
@@ -128,9 +155,17 @@ def coerce_produced_files(
     items: Iterable[Any],
     *,
     normalize_paths: bool = True,
+    checksum_policy: "ChecksumPolicy" = "auto",
+    max_checksum_bytes: int | None = None,
 ) -> list["ProducedFile"]:
     return [
-        coerce_produced_file(item, normalize_paths=normalize_paths) for item in items
+        coerce_produced_file(
+            item,
+            normalize_paths=normalize_paths,
+            checksum_policy=checksum_policy,
+            max_checksum_bytes=max_checksum_bytes,
+        )
+        for item in items
     ]
 
 

{data_annotations-2.5.0 → data_annotations-2.6.0}/src/data_annotations/annotations/decorators.py

@@ -1,4 +1,6 @@
+from collections.abc import Mapping
 from functools import wraps
+from pathlib import Path
 from typing import Any, Callable
 
 from data_annotations._decorators import (
@@ -12,7 +14,8 @@ from data_annotations._decorators import (
     split_child_bundles,
 )
 from data_annotations.description.models import DocumentedArtifact, FieldDefinition
-from data_annotations.provenance.models import ArtifactKind
+from data_annotations.provenance import writers as provenance_writers
+from data_annotations.provenance.models import ArtifactKind, ChecksumPolicy
 
 from .writers import annotate_directory, annotate_file
 
@@ -29,10 +32,14 @@ def record_file_annotation(
     acquisition_context: dict[str, Any] | None = None,
     generation_context: dict[str, Any] | None = None,
     artifact_kind: ArtifactKind = "other",
+    artifact_sha256: str | None = None,
     write_readme: bool = True,
     write_schema: bool | None = None,
     annotation_suffix: str = ".annotation.json",
     readme_suffix: str = ".README.md",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ):
     """
     Decorate a function that writes one annotated artifact.
@@ -68,6 +75,7 @@ def record_file_annotation(
                 acquisition_context=acquisition_context,
                 generation_context=generation_context,
                 artifact_kind=artifact_kind,
+                artifact_sha256=artifact_sha256,
                 params=params,
                 inputs=inputs,
                 function=fn,
@@ -75,6 +83,9 @@ def record_file_annotation(
                 write_schema=write_schema,
                 annotation_suffix=annotation_suffix,
                 readme_suffix=readme_suffix,
+                checksum_policy=checksum_policy,
+                max_checksum_bytes=max_checksum_bytes,
+                checksum_overrides=checksum_overrides,
             )
             return result
 
@@ -95,6 +106,9 @@ def record_directory_annotation(
     write_schema: bool | None = None,
     annotation_filename: str = "data-annotations.json",
     readme_filename: str = "README.md",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ):
     """
     Decorate a function that writes several annotated outputs in a directory.
@@ -150,6 +164,9 @@ def record_directory_annotation(
                 write_schema=write_schema,
                 annotation_filename=annotation_filename,
                 readme_filename=readme_filename,
+                checksum_policy=checksum_policy,
+                max_checksum_bytes=max_checksum_bytes,
+                checksum_overrides=checksum_overrides,
             )
             return result
 

{data_annotations-2.5.0 → data_annotations-2.6.0}/src/data_annotations/annotations/writers.py

@@ -1,4 +1,4 @@
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from pathlib import Path
 from typing import Any, Callable
 
@@ -17,6 +17,7 @@ from data_annotations.provenance import (
     ArtifactKind,
     BaseProvenance,
     ChildBundle,
+    ChecksumPolicy,
     ProducedFile,
 )
 from data_annotations.provenance import writers as provenance_writers
@@ -154,22 +155,30 @@ def _build_file_annotation_document(
     acquisition_context: dict[str, Any] | None = None,
     generation_context: dict[str, Any] | None = None,
     artifact_kind: ArtifactKind = "other",
+    artifact_sha256: str | None = None,
     params: dict[str, Any] | None = None,
     inputs: Sequence[str | Path] | None = None,
     function: Callable[..., Any] | None = None,
     capture_mode: str = "runtime",
     provenance_overrides: dict[str, Any] | None = None,
     normalize_inputs: bool = True,
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> FileAnnotationDocument:
     manifest = provenance_writers._build_file_manifest(
         artifact_path,
         artifact_kind=artifact_kind,
+        artifact_sha256=artifact_sha256,
         params=params,
         inputs=inputs,
         function=function,
         capture_mode=capture_mode,
         overrides=provenance_overrides,
         normalize_inputs=normalize_inputs,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
 
     return FileAnnotationDocument(
@@ -211,6 +220,9 @@ def _build_directory_annotation_document(
     capture_mode: str = "runtime",
     provenance_overrides: dict[str, Any] | None = None,
     normalize_inputs: bool = True,
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> DirectoryAnnotationDocument:
     normalized_output_dir = Path(provenance_writers._normalize_local_path(output_dir))
     artifact_groups = artifact_groups or []
@@ -229,6 +241,9 @@ def _build_directory_annotation_document(
         capture_mode=capture_mode,
         overrides=provenance_overrides,
         normalize_inputs=normalize_inputs,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
 
     return DirectoryAnnotationDocument(
@@ -285,6 +300,7 @@ def write_file_annotation(
     acquisition_context: dict[str, Any] | None = None,
     generation_context: dict[str, Any] | None = None,
     artifact_kind: ArtifactKind = "other",
+    artifact_sha256: str | None = None,
     params: dict[str, Any] | None = None,
     inputs: Sequence[str | Path] | None = None,
     function: Callable[..., Any] | None = None,
@@ -292,6 +308,9 @@ def write_file_annotation(
     provenance_overrides: dict[str, Any] | None = None,
     normalize_inputs: bool = True,
     suffix: str = ".annotation.json",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> Path:
     document = _build_file_annotation_document(
         artifact_path,
@@ -303,12 +322,16 @@ def write_file_annotation(
         acquisition_context=acquisition_context,
         generation_context=generation_context,
         artifact_kind=artifact_kind,
+        artifact_sha256=artifact_sha256,
         params=params,
         inputs=inputs,
         function=function,
         capture_mode=capture_mode,
         provenance_overrides=provenance_overrides,
         normalize_inputs=normalize_inputs,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
     annotation_path = Path(str(document.subject.path) + suffix)
     return _write_annotation_document(document, annotation_path)
@@ -331,6 +354,9 @@ def write_directory_annotation(
     provenance_overrides: dict[str, Any] | None = None,
     normalize_inputs: bool = True,
     filename: str = "data-annotations.json",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> Path:
     document = _build_directory_annotation_document(
         output_dir,
@@ -347,6 +373,9 @@ def write_directory_annotation(
         capture_mode=capture_mode,
         provenance_overrides=provenance_overrides,
         normalize_inputs=normalize_inputs,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
     annotation_path = Path(document.subject.path) / filename
     return _write_annotation_document(document, annotation_path)
@@ -363,6 +392,7 @@ def annotate_file(
     acquisition_context: dict[str, Any] | None = None,
     generation_context: dict[str, Any] | None = None,
     artifact_kind: ArtifactKind = "other",
+    artifact_sha256: str | None = None,
     params: dict[str, Any] | None = None,
     inputs: Sequence[str | Path] | None = None,
     function: Callable[..., Any] | None = None,
@@ -370,6 +400,9 @@ def annotate_file(
     write_schema: bool | None = None,
     annotation_suffix: str = ".annotation.json",
     readme_suffix: str = ".README.md",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> FileAnnotationResult:
     document = _build_file_annotation_document(
         artifact_path,
@@ -381,9 +414,13 @@ def annotate_file(
         acquisition_context=acquisition_context,
         generation_context=generation_context,
         artifact_kind=artifact_kind,
+        artifact_sha256=artifact_sha256,
         params=params,
         inputs=inputs,
         function=function,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
     artifact_path = Path(document.subject.path)
     annotation_path = _write_annotation_document(
@@ -425,6 +462,9 @@ def annotate_directory(
     write_schema: bool | None = None,
     annotation_filename: str = "data-annotations.json",
     readme_filename: str = "README.md",
+    checksum_policy: ChecksumPolicy = "auto",
+    max_checksum_bytes: int = provenance_writers.DEFAULT_MAX_CHECKSUM_BYTES,
+    checksum_overrides: Mapping[str | Path, str] | None = None,
 ) -> DirectoryAnnotationResult:
     document = _build_directory_annotation_document(
         output_dir,
@@ -438,6 +478,9 @@ def annotate_directory(
         params=params,
         inputs=inputs,
         function=function,
+        checksum_policy=checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
     output_dir = Path(document.subject.path)
     annotation_path = _write_annotation_document(

{data_annotations-2.5.0 → data_annotations-2.6.0}/src/data_annotations/cli_app/annotate/__init__.py

@@ -24,6 +24,8 @@ from .helpers import (
 )
 from ..common import (
     CommandOption,
+    ChecksumPolicyOption,
+    ChecksumValuesOption,
     ForceOption,
     FunctionOption,
     GitBranchOption,
@@ -34,9 +36,11 @@ from ..common import (
     GitShaOption,
     GitTagsOption,
     InputValuesOption,
+    MaxChecksumBytesOption,
     ParamValuesOption,
     ScriptOption,
     ScriptRepoPathOption,
+    Sha256Option,
     SourceDownloadUriOption,
     SourceKindOption,
     SourcePathOption,
@@ -45,10 +49,12 @@ from ..common import (
     SourceUriOption,
     _annotation_paths_for_directory,
     _annotation_paths_for_file,
+    _collect_checksums,
     _discover_directory_entries,
     _ensure_annotation_outputs_available,
     _error,
     _validate_artifact_kind,
+    _validate_checksum_policy,
 )
 
 DEFAULT_ANNOTATION_INSTRUCTIONS = """
@@ -119,6 +125,10 @@ def annotate_file_command(
     source_path: SourcePathOption = None,
     source_revision: SourceRevisionOption = None,
     source_sha256: SourceSha256Option = None,
+    checksum_policy: ChecksumPolicyOption = "auto",
+    max_checksum_bytes: MaxChecksumBytesOption = 10 * 1024**3,
+    sha256: Sha256Option = None,
+    checksum_values: ChecksumValuesOption = None,
     force: ForceOption = False,
 ) -> None:
     file_answers = _load_file_answers(answers_path)
@@ -209,6 +219,13 @@ def annotate_file_command(
     if artifact_kind in {"dataset", "table"}:
         if is_interactive and file_answers is None:
             fields, primary_key, missing_value_codes = prompts._prompt_schema_details()
+    selected_checksum_policy = _validate_checksum_policy(checksum_policy)
+    checksum_overrides: dict[str | Path, str] = _collect_checksums(checksum_values)
+    artifact_sha256 = (
+        sha256
+        if sha256 is not None
+        else (file_answers.sha256 if file_answers else None)
+    )
 
     annotation_path, readme_path = _write_post_hoc_file_bundle(
         artifact_path,
@@ -221,6 +238,10 @@ def annotate_file_command(
         inputs=inputs,
         params=params,
         provenance_overrides=provenance_overrides,
+        artifact_sha256=artifact_sha256,
+        checksum_policy=selected_checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
     typer.echo("")
     typer.echo(f"Annotation: {annotation_path}")
@@ -297,6 +318,9 @@ def annotate_directory_command(
         "--group-kind",
         help="Artifact kind for the corresponding --group-selector.",
     ),
+    checksum_policy: ChecksumPolicyOption = "auto",
+    max_checksum_bytes: MaxChecksumBytesOption = 10 * 1024**3,
+    checksum_values: ChecksumValuesOption = None,
     force: ForceOption = False,
 ) -> None:
     directory_answers = _load_directory_answers(answers_path)
@@ -407,6 +431,11 @@ def annotate_directory_command(
     )
 
     default_kind = _validate_artifact_kind(kind) if kind is not None else None
+    selected_checksum_policy = _validate_checksum_policy(checksum_policy)
+    checksum_overrides: dict[str | Path, str] = (
+        dict(directory_answers.checksums) if directory_answers is not None else {}
+    )
+    checksum_overrides.update(_collect_checksums(checksum_values))
     if directory_answers is not None and has_answers_inventory:
         artifacts = _documented_artifacts_from_answers(directory_answers.artifacts)
         if not group_selector_values:
@@ -486,6 +515,9 @@ def annotate_directory_command(
         inputs=inputs,
         params=params,
         provenance_overrides=provenance_overrides,
+        checksum_policy=selected_checksum_policy,
+        max_checksum_bytes=max_checksum_bytes,
+        checksum_overrides=checksum_overrides,
     )
 
     typer.echo(f"Annotation: {annotation_path}")