The build process must produce provenance that identifies the output package unambiguously by cryptographic digest and describes how it was produced, in a format the package ecosystem or consumer accepts. The SLSA Provenance format and its associated attestation suite are recommended; an alternative format must carry the information SLSA Provenance would carry at each level and should be translatable to and from it. At L1 completeness is best effort (the provenance should be enough to catch mistakes and should look the same as at higher levels, though costly fields may be missing) and there are no authenticity or accuracy requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.