{
  "schema_version": "1.0",
  "source": {
    "repository": "https://example.com/owner/repository",
    "commit_sha": "replace-with-full-commit-sha",
    "application_root": "."
  },
  "build": {
    "builder_identity": "replace-with-controlled-builder",
    "workflow_run_id": "replace-with-run-id",
    "started_at": "2026-09-02T00:00:00Z",
    "toolchain": "replace-with-versioned-toolchain"
  },
  "artifacts": [
    {
      "name": "application",
      "digest": "sha256:replace-with-digest",
      "signature_verified": false,
      "sbom_digest": "sha256:replace-with-sbom-digest"
    }
  ],
  "authorization": {
    "target_environment": "production",
    "approval_policy": "replace-with-policy",
    "approved_by": "replace-with-safe-identity"
  },
  "deployment": {
    "release_id": "replace-with-release-id",
    "deployed_at": "2026-09-02T00:00:00Z",
    "readiness": "pending",
    "routed": false
  },
  "recovery": {
    "previous_known_good_release": "replace-with-release-id",
    "configuration_compatible": "unknown"
  },
  "limitations": [
    "Provenance does not prove that source logic is correct.",
    "Health checks do not prove every business workflow."
  ]
}