• Integrity via SHA‑256 of canonical JSON payload.
• Authenticity via ECDSA (secp256k1) over HASH.
• Replay mitigation via unique ID and server‑side dedupe.
• Key management: rotation, storage in KMS/HSM.
• Not provided: confidentiality (planned in v2), anonymity.

For cross-implementation artifact verification, use docs/CONTENT_INTEGRITY_PROFILE.md.

The security boundary depends on deterministic bytes. Implementations SHOULD use RFC 8785/JCS canonicalization for artifact integrity and SHOULD NOT rely on language-native "sorted keys" JSON output. Different escaping, number formatting, or Unicode key ordering can cause honest implementations to compute different hashes for the same artifact.

When provenance links are used, include links[] inside the signed integrity payload. Links outside the signed payload are advisory only and can be rewritten without invalidating the artifact signature.