Supply-Chain

• Evidence

  The published bundle format, and how anyone re-derives what a bundle's facts imply under the rules it pinned.

• SLSA, said honestly

  What the release processes demand, mapped onto SLSA's build requirements — a claim about the definitions, never about a ticket.