← Home

Provenance

This site is built deterministically from versioned sources and validated at every boundary — the same discipline the work itself argues for. Here's what produced and checked this artifact.

Provenance chain

The build reads as an in-toto / SLSA-style provenance: declared materials, a checked build process, and a signed subject. Each link is verified; the last is the artifact itself.

  1. Materials
    • git+github.com/bdelanghe/site706757a
    • @bdelanghe/brandf86240588
    • data/profile.jsonsha256:b40b8da23a6…
    • data/presentation.jsonsha256:e97f9cef071…
    • data/site.jsonsha256:b4ec0b94094…
    • brand/tokens/tokens.jsonsha256:8543ea4ad60…
    • brand/tokens/tokens.csssha256:a63f40c416a…
    • brand/content/strings.jsonsha256:0565a871d37…
    • brand/css/base.csssha256:c2d23568b53…
    • brand/css/fonts.csssha256:5bd512e4f45…
    198 repos · 125 public · 188 sources · 12 languages — these corpus figures are computed over this corpus, not asserted; the résumé's outcome metrics are asserted, each grounding-checked in CI.
  2. Process · contractsContracts gate content before a byte renders: the canonical résumé data/profile.json (sha256:b40b8da23a6…) against the JSON Resume schema contract/jsonresume.schema.json (sha256:ff6e39e79cf…), the render-context data/presentation.json (sha256:e97f9cef071…) against contract/presentation.schema.json (sha256:785e66eb7e7…), and every post's frontmatter against contract/posts.schema.json (sha256:d6eb84a7d08…) — a non-conforming change can't build, so invalid states are unrepresentable at the boundary. Facts then transclude from canonical tokens ({{thesis}}, {{proof.*}}, {{email}}); an unknown token fails the build, so no claim is unsourced.
  3. Process · gatesGates run on every build, each error-severity finding blocking it: lone blesses each rendered post's DOM (semantic HTML + a11y); copy-review.mjs (sha256:63dd5d68edb…) flags overclaims via Claude; linkedin-check.mjs (sha256:ae16a738f13…) verifies résumé claims against the saved source; string-audit runs the deterministic copy-hygiene suite; the structured data (JSON-LD 1.1) is validated against SHACL shapes; an SPDX SBOM is generated and completeness-checked; and @bdelanghe/brand tokens are drift-checked against the committed tokens.css. Every gate's result is then folded — together with the SBOM and the signed in-toto/SLSA attestation below — into a single honest conformance projection: lone's conformance() model, which emits the strong WCAG 2.2 AA / OWASP ASVS claim only when every required criterion is met — manual and unsupplied criteria stay not-assessed, never overclaimed.
  4. BuilderRendered by build.mjs (sha256:33f36112cff…) under a toolchain pinned by flake.lock — Node 22 + @bdelanghe/brand @ f86240588. Hermetic: no network, no GitHub at build — the same materials always produce the same subject, a reproducible function of the inputs above. See the colophon for what built and validated it.

  5. Subject — signed

    commit 706757a · 2026-07-27 · bdelanghe/site

    Real in-toto Statement/v1 + SLSA provenance (attestation.intoto.json), keyless-signed via Sigstore — a one-build Fulcio certificate minted from this workflow's GitHub OIDC identity, logged in the public Rekor transparency log — this build's entry. No held key. The whole built site is content-addressed (site.sha256) and signed too, and pushed to GHCR as a pullable, signed OCI artifact. See provenance.json for digests, Rekor entries, and verify/pull recipes. This proves who built the site and that it is intact.

    Authorized. Production is not deployed straight from a build: each version is first uploaded as an un-served preview, reviewed, and promoted to production only on required human approval (the site-promote environment). The exact reviewed, signed version is what goes live — so the live site is not just intact, its promotion was authorized.