design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources

Parent: #6019 (semi-automated ingestion operations). Research source: prior-art doc ~/workspace/scratch/atlas-ingestion-brief-2026-11-04/prior-art-research.md (2026-11-04). Follow-up 19 (Cluster 3). Provenance substrate: #3125.

Finding (research, in substance)

in-toto / SLSA show how to bind a claim to content: an attestation = envelope + subject (artifacts by digest) + predicate (typed claim); SLSA's predicate carries builder identity, build parameters, and materials (input artifacts with digests). Translated to ingestion, each batch gets an attestation-shaped record:

subject = the chunk/span hashes written;
materials = the source files' hashes + source marks (sibling grammar design under atlas ingestion program: semi-automated updates, versioning, provenance, feedback — long-term design + tasks (2026-11-04 brief) #6018);
builder = ingester name + version (+ git hash, per the fleet's versioning ruling);
predicate extras = classification tier + scan results (classification design family under atlas ingestion program: semi-automated updates, versioning, provenance, feedback — long-term design + tasks (2026-11-04 brief) #6018).

Signing is optional for a personal system; the shape is the value — "where did this embed come from" becomes a record lookup, not archaeology.

Scope

Record schema + where it lives (beside the staging/publish gate, sibling under design(atlas): semi-automated ingestion operations — source set, usefulness filter, disk/IO + plan-spend guardrails #6019); one attestation per batch, covering publish and rejection outcomes.
How attestations chain: a re-ingest of the same source references the prior batch's attestation.

Done looks like

A record schema design + emission points in the ingest pipeline.

CODE-1710

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-v
Session / ID: task 10411
Found via: queue claim
Task: Triage issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 — assigned to the opencode execution lane; handed off to the laptop claimant, not worked by this lane.
Expectation: claimant launches the bound opencode session for task 10411.
Links: n/a

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-y
Session / ID: task 10411
Found via: queue claim
Task: Triage of issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 handed off to the opencode execution lane (assigned_lane=opencode, session not yet bound).
Expectation: The laptop claimant launches the bound opencode session for task 10411, which drives it to its terminal state.
Links: issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045

🤖 Agent note · state: handed off

Agent: queue worker (repo-worker-code), lane code-i
Session / ID: task 10411
Found via: queue claim
Task: triage of issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 (design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources) is assigned to the opencode execution lane — handed off to the opencode claimant, which launches a bound session to drive task 10411 to its terminal state.
Expectation: claimant launches the bound opencode session during the park window; if unbound at lease expiry, task 10411 returns to the queue.
Links: issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane 9aca43b4-5439-4939-9f71-323f5d32521b
Session / ID: task 10411
Found via: queue claim · repo-health-code-pilot
Task: Freshly revalidate issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 (Atlas ingest-attestation design) and check for active ownership before routing or implementing. The prior queue checkpoint assigned this to the OpenCode execution lane.
Expectation: Triage the issue against current main and its design/PR context; do not duplicate active work.
Links: design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045

🤖 Agent note · done (triaged)

Agent: queue worker (repo-worker-code), lane 9aca43b4-5439-4939-9f71-323f5d32521b
Session / ID: task 10411
Found via: queue claim · repo-health-code-pilot
Task: Fresh verification on 2026-11-05: issue design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 remains OPEN, has no hard-stop labels, and no matching open PR was found. design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 is a distinct design slice, not a duplicate of the existing provenance registry atlas: provenance registry (chunk occurrences), content-addressed extracts, multi-DB vector resolution #3125 or source-mark grammar design design(atlas): source-mark grammar — one parser + one formatter for composite provenance marks #6044. Parent design(atlas): semi-automated ingestion operations — source set, usefulness filter, disk/IO + plan-spend guardrails #6019 and tracker atlas ingestion program: semi-automated updates, versioning, provenance, feedback — long-term design + tasks (2026-11-04 brief) #6018 remain OPEN.
Disposition / ordering: Keep design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 open as a design task. Schema design may proceed alongside design(atlas): source-mark grammar — one parser + one formatter for composite provenance marks #6044, but should reuse/extend atlas: provenance registry (chunk occurrences), content-addressed extracts, multi-DB vector resolution #3125 and use the canonical source-mark grammar. Implementation should follow the schema and integrate with the staging/classification/provenance publish gate (atlas staging tier: versioned schema, registry, aggregator with merge-on-close promotion into three-level core #5669 / design(atlas): staging-shard ingest gate — write → classify → dedup → provenance-check → publish #6057); cover both publish and rejection outcomes and link re-ingests to the prior batch attestation. No code fix or duplicate follow-up task is warranted by this triage.
Links: design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045 · design(atlas): semi-automated ingestion operations — source set, usefulness filter, disk/IO + plan-spend guardrails #6019 · atlas: provenance registry (chunk occurrences), content-addressed extracts, multi-DB vector resolution #3125 · design(atlas): source-mark grammar — one parser + one formatter for composite provenance marks #6044 · design(atlas): staging-shard ingest gate — write → classify → dedup → provenance-check → publish #6057

Navigation Menu

Repository navigation

design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045

Finding (research, in substance)

Scope

Done looks like

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

design(atlas): ingest attestation record — in-toto-shaped per-batch statement binding chunks to sources #6045

Description

Finding (research, in substance)

Scope

Done looks like

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions