Per Sigstore: Rekor transparency log. Requirements include (a) record signing events to Rekor + (b) verify signatures + Rekor entries + (c) implement verification policy + (d) integrate with consumers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.