Provenance

Provenance chain

The build reads as an in-toto / SLSA-style provenance: declared materials, a checked build process, and a signed subject. Each link is verified; the last is the artifact itself.

1. Materials
   • git+github.com/bdelanghe/site 2481b63
   • @bdelanghe/brand v0.1.0
   • data/profile.json sha256:482e8f2684a…
   • data/presentation.json sha256:f759310bcbd…
   • data/site.json sha256:97b233de7b4…
   • brand/tokens/tokens.json sha256:e683fcb75ab…
   • brand/tokens/tokens.css sha256:faae54d34bf…
   • brand/content/strings.json sha256:ac16305587e…
   • brand/css/base.css sha256:c2d23568b53…
   • brand/css/fonts.css sha256:3d112863aff…

   203 repos · 130 public · 192 sources · 13 languages — these corpus figures are computed over this corpus, not asserted; the résumé's outcome metrics are asserted, each grounding-checked in CI.

2. Process · contracts

   Contracts gate content before a byte renders: the canonical résumé data/profile.json (sha256:482e8f2684a…) against the JSON Resume schema contract/jsonresume.schema.json (sha256:ff6e39e79cf…), the render-context data/presentation.json (sha256:f759310bcbd…) against contract/presentation.schema.json (sha256:9a3787ecca7…), and every post's frontmatter against contract/posts.schema.json (sha256:d6eb84a7d08…) — a non-conforming change can't build, so invalid states are unrepresentable at the boundary. Facts then transclude from canonical tokens ({{thesis}}, {{proof.*}}, {{email}}); an unknown token fails the build, so no claim is unsourced.

3. Process · gates

   Gates run on every build, each error-severity finding blocking it: lone blesses each rendered post's DOM (semantic HTML + a11y); copy-review.mjs (sha256:2f923ff5f5e…) flags overclaims via Claude; linkedin-check.mjs (sha256:ae16a738f13…) verifies résumé claims against the saved source; string-audit runs the deterministic copy-hygiene suite; the structured data (JSON-LD 1.1) is validated against SHACL shapes; an SPDX SBOM is generated and completeness-checked; and @bdelanghe/brand tokens are drift-checked against the committed tokens.css. Every gate's result is then folded — together with the SBOM and the signed in-toto/SLSA attestation below — into a single honest conformance projection: lone's conformance() model, which emits the strong WCAG 2.2 AA / OWASP ASVS claim only when every required criterion is met — manual and unsupplied criteria stay not-assessed, never overclaimed.

4. Builder

   Rendered by build.mjs (sha256:cfe00d1ffd5…) under a toolchain pinned by flake.lock — Node 22 + @bdelanghe/brand v0.1.0. Hermetic: no network, no GitHub at build — the same materials always produce the same subject, a reproducible function of the inputs above. See the colophon for what built and validated it.

5. Subject — signed

   commit 2481b63 · 2026-08-27 · bdelanghe/site

   Real in-toto Statement/v1 + SLSA provenance (attestation.intoto.json), keyless-signed via Sigstore — a one-build Fulcio certificate minted from this workflow's GitHub OIDC identity, logged in the public Rekor transparency log — this build's entry. No held key. The whole built site is content-addressed (site.sha256) and signed too, and pushed to GHCR as a pullable, signed OCI artifact. See provenance.json for digests, Rekor entries, and verify/pull recipes. This proves who built the site and that it is intact.

   Authorized. Production is not deployed straight from a build: each version is first uploaded as an un-served preview, reviewed, and promoted to production only on required human approval (the site-promote environment). The exact reviewed, signed version is what goes live — so the live site is not just intact, its promotion was authorized.