Evidence limitation

Build provenance is not runtime operation

Direct limitation

It does not prove that the same artifact is deployed, configured correctly, reachable, authorized or currently performing its function.

Stable record: LIM-K02-006
Claim status: PROJECT DOCTRINE
Last reviewed: 2026-08-16
Research cutoff: 2026-08-16
Source type: EVIDENCE LIMITATION
Currentness: Current for release 2.1.0; external sources require periodic revalidation.
Correction state: No unresolved public correction recorded for this release.
Machine record: Static JSON record

Supply-chain provenance can support how an artifact was built and by which process.

It does not prove that the same artifact is deployed, configured correctly, reachable, authorized or currently performing its function.

Release evidence can be mistaken for service evidence.

Bind build provenance to deployment records, runtime measurement, service observation and authorized state transitions.

Supply-chain Levels for Software Artifacts (SLSA) Specification v1.2 — OpenSSF; SLSA v1.2; Approved. Exact claim-support entries: 2. Revalidated 2026-08-14T22:04:09Z.
in-toto Attestation Framework — in-toto project; Current project framework; Open standard; CNCF graduated project. Exact claim-support entries: 1. Revalidated 2026-08-14T22:04:09Z.