Provenance must resist forgery by tenants strongly. Any secret used to authenticate it, such as the signing key, must be held in a secure management system suited to such material and reachable only by the build service account, and must never be reachable from the environment that runs user-defined build steps. Every provenance field must be generated or checked by the platform in a trusted control plane; user-controlled steps must not be able to insert or change content, except for the fields allowed at L2. L3 adds no fields beyond those of L2. Completeness: should be complete, with every external parameter listed, and resolved dependencies remain best effort. (Called non-falsifiable in v0.1.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.