Source provenance attestations record how a revision was created and came to be on a protected branch or pointed to by a tag, as facts stated by the SCS. The SCS must document the format and purpose of every provenance attestation it issues and how each supports the properties summarised in the VSA; must create provenance at the same time the branch is updated, so it forms a credible, auditable record; and must let anyone authorised to access a revision access its provenance. The SCS may make no claim about some revisions (for example ones created elsewhere, on unprotected branches or outside the expected process). The authority issuing source VSAs must know which entity should issue each provenance type and ensure each comes from its expected issuer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.