Ship the data and the evidence needed to refuse it.
A release process can attach more than a checksum. It can publish signed origin and transformation statements, required profiles, an exact handoff, and the verifier inputs a consumer needs.
A release has two independently reviewed artifacts
| Data artifact | Evidence handoff |
|---|---|
| Exact files or signed dataset manifest, media types, sizes, and digests. | Signed statement graph, roots, heads, required profiles, and final artifact bindings. |
| Published through the normal data distribution channel. | Published with immutable digests and a receiver-verifiable policy example. |
| Can be mirrored without changing its identity. | Can be verified without access to the producer's CI or warehouse. |
CI is a trigger, not the attester
A workflow event can initiate generation after release bytes are final. The signer identity, key custody, source claim, exact predecessor graph, and expected release manifest still require explicit policy. A green CI badge alone is not provenance.
Concrete release receipt
| Input | The exact dataset files or deterministic dataset manifest selected for publication. |
|---|---|
| Release step | CI triggers generation only after bytes are final; a release signer attests the exact graph and handoff. |
| Consumer step | The recipient downloads the release and hashes those bytes against the signed final-artifact binding. |
| Expected failures | A changed file denies on artifact digest; a correctly signed receipt from an untrusted key denies on authorization. |