StellaOps Provenance (Relocated)

Relocated (Sprint 204, 2026-03-04): the Provenance module source now lives under the Attestor trust domain.
Source code: src/Attestor/StellaOps.Provenance.Attestation/ and src/Attestor/StellaOps.Provenance.Attestation.Tool/.
Architecture: the Attestor architecture dossier.
Archived standalone docs: docs-archive/modules/provenance/.

This page is kept as a stable landing point. Read on for the unchanged public surface of the provenance library and the offline forensic-verify CLI tool.

Purpose (unchanged)

Provenance is a library (not a standalone service) that provides deterministic, verifiable provenance attestations for all StellaOps artifacts. It enables SLSA compliance through DSSE statement generation, Merkle tree construction, and cryptographic verification.

Public surface (`StellaOps.Provenance.Attestation`)

The library code lives directly under src/Attestor/StellaOps.Provenance.Attestation/. Its public surface (grounded in BuildModels.cs, Signers.cs, and Verification.cs) is:

SLSA build model — BuildDefinition, BuildMetadata, BuildStatement (+ BuildStatementFactory), with CanonicalJson deterministic serialization and BuildStatementDigest.ComputeHash/ComputeMerkleRoot.
Merkle construction — MerkleTree.ComputeRoot over leaves hashed with HashPurpose.Merkle.
Signing — ISigner with HmacSigner, CosignSigner, KmsSigner; key providers IKeyProvider, InMemoryKeyProvider, RotatingKeyProvider; audit via IAuditSink (NullAuditSink, InMemoryAuditSink).
Verification — IVerifier/HmacVerifier, MerkleRootVerifier, ChainOfCustodyVerifier, returning VerificationResult(IsValid, Reason, VerifiedAt).

Signatures carry a JWS-style alg tag on SignResult.Alg (default HS256). Both signer and verifier dispatch on the active compliance profile, including the regional MACs HSGost3411 and HSSm3 alongside HS256/HS384/HS512 (see HmacSigner.MapHmacAlgorithmToJwsTag and HmacVerifier.ComputeExpectedMac).

Forensic verification CLI tool

src/Attestor/StellaOps.Provenance.Attestation.Tool/ ships a preview .NET 10 global tool, stella-forensic-verify, for offline, network-free, deterministic verification of HMAC-signed provenance payloads (--payload, --signature-hex, --key-hex, …; exit 0 = valid, 2 = signature/time invalid, 1 = bad args). See src/Attestor/StellaOps.Provenance.Attestation.Tool/README.md for usage and offline-kit packaging.

Note on StellaOps.Provenance (shared library)

The src/__Libraries/StellaOps.Provenance/ library is a separate, lower-level provenance data model (DSSE/Rekor/trust types: DsseProvenance, DsseChainLink, DsseRekorInfo, TrustInfo, and the Document* value model) referenced by StellaOps.Concelier.Core and StellaOps.Concelier.Federation. It depends on StellaOps.Concelier.Models. It was NOT moved by Sprint 204 and remains at its original location.

Why the move

Provenance attestation libraries are consumed primarily by the Attestor trust domain (proofchain, evidence packs, verification). Consolidating source ownership under src/Attestor/ clarifies trust-boundary responsibilities.