Provenance Appendix Checklist (SIGNALS-24-003)

Audience: Signals Guild, Runtime Guild, Authority Guild.

Purpose: Enrich runtime facts with verifiable provenance — who produced the fact, from which build, and with what signature — so reachability evidence is auditable end to end. This checklist advances SIGNALS-24-003 once CAS promotion (SIGNALS-24-002) is approved.

Every runtime fact that contributes to a release decision carries a provenance record alongside its content-addressed blob. The fields below let an auditor trace a fact back to its source host, pipeline build, and signing key, with an optional Rekor anchor when transparency logging is online.

Required fields (per runtime fact)

• callgraph_id (matches CAS manifest id)
• ingested_at (UTC ISO-8601), received_at
• tenant
• source (host/service emitting facts)
• pipeline_version (git SHA or build ID)
• provenance_hash (sha256 of raw fact blob)
• signer (key id) and optional rekor_uuid or skip_reason: offline

Steps

1. Freeze provenance JSON schema (provenance.runtime.fact.v1).
2. Add enrichment stage writing provenance into CAS alongside runtime facts.
3. Emit DSSE attestation per batch of runtime facts; store in CAS.
4. Update /signals/runtime-facts/ndjson handler to return provenance_hash and callgraph_id when available.
5. Add validation tests to ensure add-only evolution and deterministic ordering.

Deliverables

• Schema file: docs/modules/signals/guides/provenance-24-003.md (this file) with field list and invariants.
• Test fixtures: reuse tests/reachability/corpus/*/vex.openvex.json provenance anchors; add provenance_hash coverage to ReachabilityLatticeTests when available.

Owners

Status

• Checklist published 2025-11-19; awaiting schema/signing approval to proceed.

Related

• CAS Promotion Checklist (SIGNALS-24-002) — upstream dependency; provenance enrichment writes alongside CAS-stored facts.
• Runtime Facts — evidence boundary and ingestion rules for the facts this provenance describes.
• signals.fact.updated Event Contract (SIGNALS-24-005) — event that carries the provenance_hash to downstream consumers.