Level 1: Provenance Exists

Requirement: The producer MUST generate a machine-readable attestation for each data artifact that claims L1 compliance.

Requirement: For data collection/ingestion, the producer MUST document the data source using the origin/v1 predicate type.

Example Origin Attestation

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [{
    "name": "dataset:customer_orders_2025q1",
    "digest": {
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    }
  }],
  "predicateType": "https://makoto.dev/origin/v1",
  "predicate": {
    "origin": {
      "source": "https://erp.example.com/api/v2/orders",
      "sourceType": "api",
      "collectionTimestamp": "2025-01-15T08:00:00Z",
      "collectionMethod": "pull"
    },
    "collector": {
      "id": "data-platform/ingestion-service-v3"
    }
  }
}

Requirement: For data transformations (ETL, filtering, aggregation, etc.), the producer MUST document each processing step using the transform/v1 predicate type.

Example Transform Attestation

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [{
    "name": "dataset:customer_orders_anonymized",
    "digest": {
      "sha256": "a1b2c3d4e5f6..."
    }
  }],
  "predicateType": "https://makoto.dev/transform/v1",
  "predicate": {
    "inputs": [{
      "name": "dataset:customer_orders_2025q1",
      "digest": { "sha256": "e3b0c44298fc1c149..." }
    }],
    "transform": {
      "type": "https://makoto.dev/transforms/anonymization",
      "name": "PII Removal",
      "parameters": {
        "fields_removed": ["email", "phone"],
        "fields_hashed": ["customer_id"]
      }
    },
    "executor": {
      "id": "data-platform/etl-pipeline-v2"
    },
    "metadata": {
      "startedOn": "2025-01-15T09:00:00Z",
      "finishedOn": "2025-01-15T09:15:00Z"
    }
  }
}

Requirement: Each attestation MUST identify the data artifact it describes via the subject field.

Note: The digest provides content binding—if data changes, the digest changes. This allows verification that attestations match their referenced data.

Check: Verify that a machine-readable attestation exists for the data artifact.

• PASS: Attestation file exists and is valid JSON
• FAIL: No attestation found, or attestation is not valid JSON

Check: Verify that the attestation conforms to the Makoto schema.

JSON Schema files for validation are available in the schemas directory.

Check: Verify that the attestation subject matches the actual data.

1. Compute SHA-256 hash of the data artifact
2. Compare computed hash to subject[].digest.sha256 in attestation
3. PASS: Hashes match
4. FAIL: Hashes do not match (data may have been modified)

# Example verification (bash)
EXPECTED=$(jq -r '.subject[0].digest.sha256' attestation.json)
ACTUAL=$(sha256sum data.json | cut -d' ' -f1)

if [ "$EXPECTED" = "$ACTUAL" ]; then
  echo "PASS: Data matches attestation"
else
  echo "FAIL: Data hash mismatch"
fi

Check: Verify that all required fields for the predicate type are present and non-empty.

For origin/v1:

• predicate.origin.source — non-empty string
• predicate.origin.collectionTimestamp — valid ISO 8601 timestamp
• predicate.collector.id — non-empty string

For transform/v1:

• predicate.inputs — non-empty array
• predicate.transform.type — non-empty string (URI)
• predicate.executor.id — non-empty string

Producer Checklist

• ☐ Attestation is generated for each data artifact
• ☐ Attestation uses in-toto Statement v1 format
• ☐ Predicate type is a valid Makoto type URL
• ☐ Subject includes artifact name and SHA-256 digest
• ☐ Origin attestations include source and collection timestamp
• ☐ Transform attestations include inputs and transform type
• ☐ All required fields are present and non-empty

Platform Checklist

• ☐ Platform can generate Makoto-compliant attestations
• ☐ Platform stores attestations persistently
• ☐ Consumers can discover and retrieve attestations
• ☐ Attestation discovery mechanism is documented

Verification Checklist

• ☐ Attestation exists and parses as valid JSON
• ☐ Attestation validates against Makoto JSON Schema
• ☐ Data artifact hash matches attestation subject digest
• ☐ All required fields for predicate type are present