docs(provenance): bind immutable Space source

SPACE_PROVENANCE.json

@@ -0,0 +1,54 @@
+{
+  "schema": "szl.space-source-attestation/v1",
+  "observed_at": "2026-07-12T01:54:25Z",
+  "space": {
+    "id": "SZLHOLDINGS/david-leads",
+    "repository_type": "space",
+    "sdk": "docker",
+    "runtime_stage_observed": "RUNNING",
+    "artifact_kind": "space-repository-snapshot",
+    "purpose": "Public-data insurance lead intelligence with bounded Ouroboros proposals and provenance receipts.",
+    "source_files_reviewed": [
+      "README.md",
+      "Dockerfile",
+      "app/server.py",
+      "app/oroboros.py",
+      "app/formulas.py"
+    ]
+  },
+  "source_of_record": {
+    "state": "VERIFIED_HF_SOURCE_OF_RECORD",
+    "relation": "hf-native-source-of-record",
+    "platform": "huggingface",
+    "repository": "SZLHOLDINGS/david-leads",
+    "artifact_base_revision": "fdac85e487a110f0022453480f977d63b90883e6",
+    "artifact_base_state": "MEASURED_PRE_ATTESTATION_BASE",
+    "artifact_base_url": "https://huggingface.co/spaces/SZLHOLDINGS/david-leads/tree/fdac85e487a110f0022453480f977d63b90883e6",
+    "file_count": 48,
+    "total_bytes": 2592487,
+    "tree_sha256": "0d5bc15b25b57a87c46b8e414b11dfcda467c1f6e8538bc0a80ada2663893ec1",
+    "tree_hash_algorithm": "sha256 of UTF-8 path + NUL + per-file content sha256 + LF, sorted by path; .cache excluded"
+  },
+  "public_github": {
+    "state": "NO_DIRECT_PUBLIC_SAME_NAME_REPOSITORY_OBSERVED",
+    "same_name_candidate": "https://github.com/szl-holdings/david-leads",
+    "same_name_candidate_http_status": 404,
+    "observation_semantics": "A public 404 does not establish the absence of a private repository.",
+    "contextual_references": [
+      "https://github.com/szl-holdings"
+    ],
+    "contextual_reference_role": "DOCUMENTATION_RESEARCH_DEPENDENCY_OR_ORGANIZATION_CONTEXT_NOT_BUILD_SOURCE_PARITY"
+  },
+  "claims": {
+    "full_github_repository_parity": "NOT_CLAIMED",
+    "reproducible_build": "NOT_CLAIMED",
+    "binary_provenance": "NOT_CLAIMED",
+    "serving_process_revision": "NOT_CLAIMED"
+  },
+  "limits": [
+    "The attestation overlay cannot self-embed its resulting Hub commit, so artifact_base_revision is the immutable measured pre-overlay tree.",
+    "Repository-head evidence does not prove the exact serving-process revision during a rolling deployment.",
+    "Reproducible build, binary provenance, and serving-process identity are not claimed.",
+    "No claim is made about private repositories or unobserved producer systems."
+  ]
+}