SLSA provenance: a supply-chain framework, and records of how software was built.

01Definition

Levels of assurance about how software was made.

SLSA (Supply-chain Levels for Software Artifacts) is a framework that describes increasing levels of assurance that a piece of software was built from the source it claims, by the process it claims, without tampering. Provenance is the record at the heart of it: a signed statement of what was built, from which source, by which builder.

Higher levels ask more of the build platform, such as isolation between builds and provenance the build itself cannot forge.

• A framework of levels
• Provenance records how it was built
• Higher levels, stronger builders

02Where it stops

Provenance says how code was built, not whether it is right.

SLSA answers “was this artifact built honestly from this source?”. It does not ask whether the source change was any good. With AI writing more of the source, a second record is useful beside provenance: what was checked about the change before it was merged.

That is the gap a verified change receipt is designed to fill.

• Build integrity, not change quality
• A gap for AI-written source
• Receipts sit beside provenance

03In Verify

Complementary, not a replacement.

Verify does not produce build provenance. Its planned signed receipts record what was checked about a pull request, using the same attestation machinery that SLSA provenance uses on GitHub. Signing is written and tested in code but not live end to end yet.

Verify is not installable yet.