Build provenance attestation Mastery Check

Provenance ties a delivered artifact to build metadata such as source revision and builder identity, enabling later verification of where it came from. It exists mainly to rename pipeline jobs without changing delivery behavior. It should always be implemented with unrestricted credentials. It removes the need to verify pipeline failures or deployment state.