# Provenance

> This site is built deterministically from versioned sources and validated at every boundary — the same discipline the work itself argues for. Here's what produced and checked this artifact.

## Provenance chain

The build reads as an **[in-toto](https://in-toto.io) / [SLSA](https://slsa.dev)-style** provenance: declared _materials_, a checked build _process_, and a signed _subject_. Each link is verified; the last is the artifact itself.

### Materials
- `git+github.com/bdelanghe/site` — 706757a
- `@bdelanghe/brand` — f86240588
- `data/profile.json` — sha256:b40b8da23a6…
- `data/presentation.json` — sha256:e97f9cef071…
- `data/site.json` — sha256:b4ec0b94094…
- `brand/tokens/tokens.json` — sha256:8543ea4ad60…
- `brand/tokens/tokens.css` — sha256:a63f40c416a…
- `brand/content/strings.json` — sha256:0565a871d37…
- `brand/css/base.css` — sha256:c2d23568b53…
- `brand/css/fonts.css` — sha256:5bd512e4f45…

198 repos · 125 public · 188 sources · 12 languages — corpus figures computed over the corpus, not asserted.

### Process · contracts
Contracts gate content before a byte renders: the canonical résumé `data/profile.json` against the JSON Resume schema, the render-context `data/presentation.json`, and every post's frontmatter against `contract/posts.schema.json` — a non-conforming change can't build. Facts transclude from canonical tokens; an unknown token fails the build, so no claim is unsourced.

### Process · gates
Gates run on every build, each error-severity finding blocking it: `lone` blesses each rendered DOM (semantic HTML + a11y); `copy-review` flags overclaims; `linkedin-check` verifies résumé claims; `string-audit` runs copy hygiene; JSON-LD is SHACL-validated; an SPDX SBOM is generated + completeness-checked; brand tokens are drift-checked. Every result folds into one honest [conformance projection](https://robertdelanghe.dev/conformance) — lone's `conformance()` model, which emits the strong WCAG 2.2 AA / OWASP ASVS claim only when every required criterion is met; manual and unsupplied criteria stay not-assessed.

### Builder
Rendered by `build.mjs` under a toolchain pinned by `flake.lock` — Node 22 + @bdelanghe/brand @ f86240588. Hermetic: no network, no GitHub at build — a reproducible function of the inputs. See the [colophon](https://robertdelanghe.dev/colophon.md) for what built and validated it.

## Subject — signed
commit [706757a](https://github.com/bdelanghe/site/commit/706757a7446b9de170bdae8ed2967dded8edcc22) · 2026-07-27 · [bdelanghe/site](https://github.com/bdelanghe/site)

Real in-toto `Statement/v1` + SLSA provenance ([attestation.intoto.json](https://robertdelanghe.dev/attestation.intoto.json)), keyless-signed via Sigstore — a one-build Fulcio certificate minted from this workflow's GitHub OIDC identity, logged in the public [Rekor](https://search.sigstore.dev/) transparency log. The whole built site is content-addressed ([site.sha256](https://robertdelanghe.dev/site.sha256)) and signed, and pushed to GHCR as a pullable, signed OCI artifact. See [provenance.json](https://robertdelanghe.dev/provenance.json) for digests, Rekor entries, and verify/pull recipes.

**Authorized.** Production is not deployed straight from a build: each version is uploaded as an un-served preview, reviewed, and promoted to production only on required human approval (the `site-promote` environment) — so the live site is not just intact, its promotion was authorized.