{"schema":"orbis-build-provenance/1","attestation":{"available":false,"reason":"No signed build provenance yet. GitHub artifact attestations are refused for user-owned PRIVATE repositories (verified 2026-08-01: POST /repos/{owner}/{repo}/attestations → 422 \"Feature not available for user-owned private repositories\"). The deploy workflow already carries the attest step; it activates when the repository becomes public or moves to an organization on a plan that permits it. Until then the commit below is a CLAIM by this server, checkable against the source but not signed by anything outside it."},"recipe":"https://orbis.id/developers#provenance","commit":"f848c02dd729af3a9afa0cc7872f820c13c94f35","sourceDigest":"sha256:9c2acb64a1a3260028a5ff24232b0c55dd2d0a9736f5000031849c8a1072284f","observedSourceDigest":"sha256:864f9023a9bbcd204dae0c7eee00d2735e16b5bc90de867cade34c248714faf9","matches":false,"divergence":{"missing":0,"changed":0,"extra":86}}