# Artifacts and Provenance Domain

**Status:** Approved target-state baseline  
**First meaningful evidence:** when distributable artifacts exist  
**Full activation:** I6.

## Target State

`Artifact` is an immutable build/package/image/output identity with source/build provenance and integrity evidence. It is independent of `Release` and `Deployment`.

```text
source revision / ChangeSet
  -> build
  -> Artifact digest
       SBOM
       provenance
       signature/attestation
       vulnerability result
  -> Release
  -> Deployment
```

## Artifact Identity

Artifact ID is AWP-owned and references immutable content digest plus provider/registry/object references. Mutable tags are labels, never sole identity.

Target metadata:

```text
kind
contentDigest
sourceRevision/ChangeSet
builder identity
build inputs
build definition/version
createdAt
storage/provider refs
SBOM refs
provenance/attestation refs
signature verification
vulnerability evidence
```

## Invariants From Day 1

- immutable digest is canonical artifact integrity identity;
- same artifact is promoted between environments where practical;
- no environment-specific rebuild silently masquerades as same Release artifact;
- evidence binds to digest;
- artifact storage credentials remain trusted provider mechanics;
- signature/provenance verification result is persisted/auditable;
- mutable registry tags can move without altering historical Artifact.

## Standards / FOSS

Baseline:

```text
CycloneDX preferred, SPDX accepted
SLSA + in-toto compatible provenance
Trivy initially for scanning and SBOM when sufficient
Cosign signing/attestation
ORAS for OCI artifact transport
Syft only when dedicated SBOM generation gives concrete benefit
```

## Lifecycle

Artifact is normally immutable once recorded. State reflects build/verification/storage availability rather than content mutation:

```text
building -> available -> verified
failed
quarantined/revoked (policy/security status, content unchanged)
```

## Increment Realization

| Increment | Artifact realization |
|---|---|
| I0/I1 | target seam only; repository package/image builds may produce basic digest evidence. |
| before I6 if meaningful artifacts distribute | begin SBOM/provenance/signature as needed. |
| I6 | full Artifact/Release product semantics and R3 integration. |
| I9 | enterprise retention/export/policy. |

## Current Implementation State

Target spec; no requirement to productize release pipeline before I6.

## Deferred Realization

Advanced artifact repository management, provenance policy languages and cross-org attestation are later additions behind standard formats.

## Temporary Dogfood Behavior

Development outputs may be unregistered until they become meaningful distributable artifacts. Once AWP depends on an artifact for Release/Deployment, digest/provenance identity is mandatory.

## Failure / Recovery

Build failure creates no successful Artifact. Registry upload timeout reconciles by digest. Vulnerability/signature failure can quarantine/block Release without deleting evidence.

## UI Implications

Artifact views surface source, digest, SBOM/provenance/signature/vulnerability status and exact Release/Deployment relationships.

## Decisions / ADRs

R3 is binding. Format/tool substitution is acceptable behind the same standards/evidence contract.