One governs the complete path from authored meaning and source to tools, providers, artifacts, releases, and later revocation. Supply-chain trust is a set of scoped claims, not a single trusted badge.
Lock every input that can change the result
The exact project lock identifies reachable semantic packages, implementation packages, source-language tools, mappings, provider catalog evidence, and other resolved inputs for each root. Build actions additionally lock source closures, toolchains, targets, configuration, environment, network policy, and declared secret requirements.
Machine-local bindings and credential values remain outside authored project meaning. Their owner-qualified revisions enter the applicable plan or action evidence without being copied into source.
Admit claims, not brands
A package or tool can claim schemas, language support, provider behavior, targets, security properties, conformance, compatibility, cost, or lifecycle. Governed admission validates each claim for its exact revision, configuration, environment, issuer, freshness, and policy.
First-party and third-party work cross the same boundary. Repository presence, installation, signature, or a passing happy-path test does not activate a provider or prove every claim.
Build from an exact action graph
Build consumes the physical selection without choosing again. Each action declares inputs, outputs, tools, environment, resource limits, network access, secrets, hermeticity, cache policy, and expected evidence.
Artifacts retain content identity, complete closure, SBOM, provenance, signatures, toolchain and target evidence, and the canonical realized Build report. Artifact bytes alone are not Build evidence.
Generated code, schemas, manifests, Dockerfiles, workflow definitions, and other operational projections use owner-aligned typed projections. Receipts record source contracts, profile, exact output, and every loss. Generated outputs remain disposable caches where their source and receipt are retained.
Publish through governed ownership
Semantic distributions, language tools, providers, adapters, and artifacts publish to typed namespaces and catalogs under explicit owner authority. Publication request, submission, observation, admission, and activation are separate records.
Consumers select exact revisions through the ordinary project and lock lifecycle. Registry availability cannot change an already locked root.
Revoke with bounded impact
A vulnerability, compromised key, invalid conformance result, malicious tool, or provider defect revokes the exact evidence dimensions it invalidates. Causal proof edges identify affected packages, locks, actions, artifacts, releases, bindings, grants, data, and effect windows.
Response can quarantine, revalidate, rotate, rebuild, replan, repair, notify, or compensate. A revocation does not rewrite what earlier reviewers knew; it adds new evidence and changes what can be trusted now.
Example
Illustrative commands retain Build and admission as distinct evidence:
one build --root AcmeShipmentProvider
one plan --root AcmeShipmentPublication
one apply plan:revision:sha256:…
one invoke one.providers#RevokeClaim@1 revoke-claim.jsonFollow Sign, admit, publish, and revoke.