Review what provenance should be recorded for the software agent nodes?

[king-shak]

Right now, it seems the only thing being recorded is the location of the executable. Is there anything else we should be considering? Do we still want to have the location of the executable, or should it just be a commit or checksum?