# Supply-Chain Attestation & Provenance
Rivox automatically generates supply-chain attestations written to `.rivox/provenance.json`.
---
## Standards Summary
- **in-toto**: Step-level link metadata.
- **SLSA Level 2**: Build provenance JSON statements.
- **SPDX 2.3 (RFC-005)**: JCS JSON formatted SBOMs with `SOURCE_DATE_EPOCH` deterministic timestamps.
- **Sigstore Rekor**: Keyless OIDC signatures registered into the Rekor transparency log.