Provenance (pointer: library source lives under src/Attestor/)

Verified against commit 942a18727c (2026-09-26). Re-verify with: pwsh tools/scripts/test-targeted-xunit.ps1 -Project src/Attestor/__Tests/StellaOps.Provenance.Attestation.Tests/StellaOps.Provenance.Attestation.Tests.csproj -BuildProjectReferences -Restore and git grep -l "StellaOps.Provenance.Attestation.csproj" -- "*.csproj".

Provenance is a library, not a service. Sprint 204 (2026-03-04) moved its source under src/Attestor/:

• src/Attestor/StellaOps.Provenance.Attestation/: the attestation library.
• src/Attestor/StellaOps.Provenance.Attestation.Tool/: the stella-forensic-verify tool.

The Attestor deployable was retired on 2026-09-05; its attestation capability moved to the Evidence service (evidence/architecture.md). src/Attestor/ remains as the signing-custody root for the StellaOps.Signer.* libraries and the Provenance library; the Provenance source did not move to src/Evidence/. The trust-domain background is in the Trust Domain Model section of the Attestor dossier. The earlier standalone Provenance documents are archived under docs-archive/modules/provenance/.

StellaOps.Provenance.Attestation

Deterministic, verifiable provenance statements for SLSA-style build attestations. The public surface (BuildModels.cs, Signers.cs, Verification.cs, PromotionAttestation.cs):

• Build model: BuildDefinition, BuildMetadata, BuildStatement and BuildStatementFactory, serialized through CanonicalJson; BuildStatementDigest.ComputeHash and ComputeMerkleRoot.
• Merkle construction: MerkleTree.ComputeRoot over leaves hashed with HashPurpose.Merkle.
• Signing: ISigner with HmacSigner, CosignSigner and KmsSigner; key providers IKeyProvider, InMemoryKeyProvider and RotatingKeyProvider; audit through IAuditSink (NullAuditSink, InMemoryAuditSink).
• Verification: IVerifier and HmacVerifier, MerkleRootVerifier, ChainOfCustodyVerifier, returning VerificationResult(IsValid, Reason, VerifiedAt).

SignResult.Alg carries a JWS-style tag. HmacSigner.MapHmacAlgorithmToJwsTag maps the active compliance profile’s signing HMAC to HS256, HS384, HS512, HSGost3411 or HSSm3, with HS256 for any unrecognized algorithm. HmacVerifier dispatches on the same tags.

Production projects that reference the library: StellaOps.Signer.Core, StellaOps.SbomService, StellaOps.Cryptography.Dsse.Signing and StellaOps.Provcache.

stella-forensic-verify

StellaOps.Provenance.Attestation.Tool packs as a .NET global tool (ToolCommandName stella-forensic-verify). It verifies an HMAC-signed payload offline and deterministically: --payload <file|->, --signature-hex, --key-hex, optional --key-id, --content-type, --signed-at, --not-after, --max-skew-minutes. Exit codes: 0 valid, 2 signature or time invalid, 1 bad arguments. See src/Attestor/StellaOps.Provenance.Attestation.Tool/README.md.

StellaOps.Provenance (separate library)

src/__Libraries/StellaOps.Provenance/ is an unrelated, lower-level data model: DSSE, Rekor and trust types (DsseProvenance, DsseChainLink, DsseKeyInfo, DsseRekorInfo, TrustInfo), a Document* value model, and ProvenanceJsonParser and ProvenanceExtensions helpers. It has no project references. At the verified commit only its test project, src/__Libraries/__Tests/StellaOps.Provenance.Tests/, references it. Sprint 204 did not move it.