Documentation · Reference

Built on top, not instead

The evidence layer is not a new security universe. It is existing provenance infrastructure with a semantic layer above it. The honest question is not “which standard we replace” but “what we add that those standards do not already say”.

What we interoperate with

Standards CodeAncestry consumes, and what it adds on top of each
Standard	Role	How it is used	What we add
W3C PROV	Provenance model	Entities, activities and agents. The lineage graph is a reading of PROV triples (wasDerivedFrom, wasGeneratedBy, used, wasAssociatedWith, wasAttributedTo), not a replacement for them.	Genetic vocabulary on top of the triples. The registry never claims PROV is optional.
SLSA 1.2	Supply-chain levels	Verifiable provenance describing where, when and how an artifact was produced. Hosted-builder attestations (a workflow URL or github-artifact-attestation) are inferred up to Build L2.	A semantic mutation record that can point at SLSA provenance. We never claim L3 from fixtures. Signatures are not re-checked in the browser.
in-toto	Signed statements	Binds a typed predicate to an immutable subject identified by digest. A mutation evaluation is exactly that shape.	Predicate types for mutation evaluation. Statements on this site are reconstructed from stored attestations; the original signed body is not in the fixtures.
CycloneDX	Component pedigree	Already models ancestors, descendants, variants, commits and patches. Ingested, never duplicated.	Capability genes and alleles above the component list. Pedigree answers “what was this built from”; a genome answers “what can it do, and who taught it”.
SPDX	Licensing	License expressions on genomes and genes. Inheritance decisions read SPDX; they never invent a second license syntax.	An explicit inheritance decision next to the expression. An unknown license stays unknown.
MCP	Tool surface	Exposes the registry and the sandbox as tools an agent may call, with an explicit scope.	The policy envelope. Holding a tool URI does not grant inheritance.
A2A	Agent messaging	Carries proposals between agents — compare, request-test, offer a mutation.	The decision still belongs to the receiving project. A2A is transport, not consent.

What CodeAncestry adds

The standards already cover pedigree, licensing, signed statements and build provenance. They do not cover:

A stable semantic capability that can be recognised across languages.
Alleles of that capability, with measured fitness in a stated environment.
A genotype / phenotype split — what the project is composed of versus how it behaved when run.
Agent identity that records deeds and forbids private reasoning.
A propagation protocol that cannot install a change on a relative without that relative's decision.

A mutation evaluation as an in-toto statement

Reconstructed from the seeded attestations on CAMUT:882. The reconstructed: true flag is required: the original signed body is not in the fixtures, and this page will not pretend otherwise.

{
  "_type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "CAMUT:882",
      "digest": {
        "sha256": "b551d07c"
      }
    }
  ],
  "predicateType": "https://codeancestry.com/attestations/mutation-evaluation/v0.1",
  "predicate": {
    "reconstructed": true,
    "sourceGenome": "CAGENOME:01JKIDSES5TC",
    "sourceCommit": "e91d4c7a03",
    "gene": "CAGENE:MIDI-SCHEDULING",
    "fromAllele": "CAALLELE:MIDI-SCHEDULING:4",
    "toAllele": "CAALLELE:MIDI-SCHEDULING:5",
    "tests": [
      {
        "id": "CAEV:991",
        "summary": "Adaptive buffer mutation: full parent suite green in an isolated sandbox.",
        "count": 214
      }
    ],
    "fitness": [
      {
        "metric": "MIDI latency p50",
        "before": "41 ms",
        "after": "19 ms",
        "change": "−22 ms",
        "direction": "better"
      },
      {
        "metric": "MIDI latency p95",
        "before": "78 ms",
        "after": "34 ms",
        "change": "−44 ms",
        "direction": "better"
      },
      {
        "metric": "CPU under load",
        "before": "18%",
        "after": "12%",
        "change": "−6 pts",
        "direction": "better"
      },
      {
        "metric": "Dropped notes / 10k",
        "before": "3.1",
        "after": "2.9",
        "change": "−0.2",
        "direction": "better"
      },
      {
        "metric": "Cyclomatic complexity",
        "before": "14",
        "after": "19",
        "change": "+5",
        "direction": "worse"
      },
      {
        "metric": "Public API surface",
        "before": "9",
        "after": "9",
        "change": "unchanged",
        "direction": "neutral"
      }
    ],
    "checklist": {
      "sourceDigestVerified": true,
      "buildProvenanceVerified": true,
      "testsPassed": true,
      "securityPolicyPassed": true,
      "licenseCompatible": true,
      "maintainerApproved": false
    }
  }
}

SLSA ceiling

Hosted-builder provenance (a workflow file URL, or a GitHub artifact attestation) is inferred only up to Build L2. Nothing on this site claims L3. An attestation marked verified in the seed data means the fixture says the signature checked at ingest — the browser does not re-check it.

Verification is local

An attestation is not itself a guarantee. A receiving project verifies the signature and independently decides whether the evidence satisfies its own adoption policy. Those are two separate steps, and the second one is never delegated upstream.