Expectations are known provenance values that mark an artifact as authentic and are tied to a package name, while provenance is tied to one artifact. They may be formed by trust on first use (accept the first version and alert on differences in later provenance, with rules for benign changes), defined by the producer (the verifier should offer an authenticated channel for the producer to set them and some protection against one party changing them alone, such as two-party control or consumer acceptance of each change), or defined in source (the package name is bound immutably to a source repository that states the rest, as in the Go ecosystem).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.