Skip to content
Sarj Repo Standards
rest/artifact/provenance-incomplete

Incomplete artifact provenance

Derived artifacts identify their source, output, configuration, and producer.

warning beta

Examples

FlaggedFails
{
  "documents": {
    "dist/bundle.json": {
      "bundled": true
    },
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json",
  "semantics": {
    "artifacts": [
      {
        "artifact": "dist/bundle.json",
        "role": "bundle"
      }
    ],
    "operations": [],
    "schema_version": 1
  }
}
PassesClean
{
  "documents": {
    "dist/bundle.json": {
      "bundled": true
    },
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "200": {
                "description": "ok"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json",
  "semantics": {
    "artifacts": [
      {
        "artifact": "dist/bundle.json",
        "derived_from": "openapi.json",
        "output_digest": "4f27ced194f5ef4c74763492e9a1b97d8bdb5ca90cb0d676089f86f9d80b2628",
        "producer": {
          "config_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "name": "fixture-bundler",
          "version": "1.2.3"
        },
        "role": "bundle",
        "source_digest": "76b48dd17d2560425745035aa6b01d2237e2d40eb04f366ad60fc8c936cd83fe"
      }
    ],
    "operations": [],
    "schema_version": 1
  }
}

Why it matters

The artifact cannot be reproduced or tied to one reviewed source and toolchain.

How detection works

A declared derived artifact omits its source, source digest, output digest, producer name or version, or configuration digest.

What is inspected

  • explicit artifact metadata for a supplied non-source artifact

Limits

  • compiling generated code
  • inferring generated artifacts from paths
  • Only explicit non-source artifact declarations are checked.
  • Paths do not imply generation, and repository code is never executed.
  • Missing fields remain advisory; contradictory evidence uses a separate error rule.

How to fix it

Complete the derivation evidence.

  1. Record one source plus source, configuration, and output digests.
  2. Record the producer name and version.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.