docs(provenance): bind immutable Space source

SPACE_PROVENANCE.json

@@ -0,0 +1,119 @@
+{
+  "schema": "szl.space-source-attestation/v1",
+  "observed_at": "2026-07-12T01:54:25Z",
+  "space": {
+    "id": "SZLHOLDINGS/yarqa",
+    "repository_type": "space",
+    "sdk": "docker",
+    "runtime_stage_observed": "RUNNING",
+    "artifact_kind": "space-repository-snapshot",
+    "purpose": "Clean-room plug-flow compartment engineering-method package and interactive Space overlay.",
+    "source_files_reviewed": [
+      "README.md",
+      "Dockerfile",
+      "pyproject.toml",
+      "space/Dockerfile",
+      "space/app.py",
+      "space/README.md",
+      "yarqa/core.py",
+      "yarqa/provenance.py"
+    ]
+  },
+  "source_of_record": {
+    "state": "VERIFIED_GITHUB_SOURCE_WITH_DECLARED_HF_OVERLAY",
+    "relation": "github-canonical-source-with-declared-hf-overlay",
+    "platform": "github+huggingface",
+    "repository": "SZLHOLDINGS/yarqa",
+    "artifact_base_revision": "9772c457290ed2185709a76c68adf240a7181e5e",
+    "artifact_base_state": "MEASURED_PRE_ATTESTATION_BASE",
+    "artifact_base_url": "https://huggingface.co/spaces/SZLHOLDINGS/yarqa/tree/9772c457290ed2185709a76c68adf240a7181e5e",
+    "file_count": 26,
+    "total_bytes": 1500729,
+    "tree_sha256": "ad222517ae7e33089a4af759ae14026be429b7b29b90bc7cedced96d5df90cb0",
+    "tree_hash_algorithm": "sha256 of UTF-8 path + NUL + per-file content sha256 + LF, sorted by path; .cache excluded",
+    "canonical_repository": "szl-holdings/yarqa",
+    "canonical_commit": "98d07ce7b72d6a5e335ea5131e52b06649e28409"
+  },
+  "public_github": {
+    "state": "VERIFIED_DECLARED_GITHUB_SOURCE_WITH_HF_OVERLAY",
+    "repository": "szl-holdings/yarqa",
+    "commit": "98d07ce7b72d6a5e335ea5131e52b06649e28409",
+    "commit_url": "https://github.com/szl-holdings/yarqa/commit/98d07ce7b72d6a5e335ea5131e52b06649e28409",
+    "deploy_declaration": {
+      "path": ".github/workflows/hf-deploy.yml",
+      "immutable_url": "https://github.com/szl-holdings/yarqa/blob/98d07ce7b72d6a5e335ea5131e52b06649e28409/.github/workflows/hf-deploy.yml",
+      "sha256": "9abd1dc0af5a72896223865596a4ae3f8137ecb93f62e90274b4edb94e0e319c",
+      "payload": [
+        "pyproject.toml",
+        "yarqa/**",
+        "space/**"
+      ],
+      "dockerfile_mapping": "HF Dockerfile == GitHub space/Dockerfile",
+      "readme_overlay": "HF root README intentionally excluded from GitHub deploy payload"
+    },
+    "comparison": {
+      "github_files_excluding_gitattributes": 56,
+      "hf_files_excluding_gitattributes": 25,
+      "common_paths": 24,
+      "byte_identical_common_paths": 23,
+      "changed_common_paths": [
+        "README.md"
+      ],
+      "github_only_paths": [
+        ".github/CODEOWNERS",
+        ".github/dependabot.yml",
+        ".github/workflows/codeql.yml",
+        ".github/workflows/dco.yml",
+        ".github/workflows/gitleaks.yml",
+        ".github/workflows/hf-deploy.yml",
+        ".github/workflows/pin-check.yml",
+        ".github/workflows/pr-title.yml",
+        ".github/workflows/receipt-sign.yml",
+        ".github/workflows/sbom.yml",
+        ".github/workflows/scorecard.yml",
+        ".github/workflows/space-ci.yml",
+        ".github/workflows/trivy.yml",
+        ".gitignore",
+        ".gitleaks.toml",
+        "CITATIONS.md",
+        "LICENSE",
+        "PROVENANCE.md",
+        "examples/synthetic_channel.py",
+        "scripts/sign_receipt.py",
+        "scripts/verify_receipt.py",
+        "tests/test_agentic.py",
+        "tests/test_attestation.py",
+        "tests/test_chain.py",
+        "tests/test_cli.py",
+        "tests/test_core.py",
+        "tests/test_meshio.py",
+        "tests/test_prediction_receipt.py",
+        "tests/test_provenance.py",
+        "tests/test_routing_topk.py",
+        "tests/test_signing.py",
+        "tests/test_surrogate.py"
+      ],
+      "hf_only_paths": [
+        "Dockerfile"
+      ],
+      "declared_deploy_payload_files": 23,
+      "declared_deploy_payload_byte_identical": 23
+    },
+    "contextual_references": [
+      "https://github.com/szl-holdings"
+    ],
+    "contextual_reference_role": "DECLARED_DEPLOY_SOURCE_PLUS_CONTEXTUAL_LINKS; FULL_REPOSITORY_PARITY_NOT_CLAIMED"
+  },
+  "claims": {
+    "full_github_repository_parity": "NOT_CLAIMED",
+    "reproducible_build": "NOT_CLAIMED",
+    "binary_provenance": "NOT_CLAIMED",
+    "serving_process_revision": "NOT_CLAIMED"
+  },
+  "limits": [
+    "The attestation overlay cannot self-embed its resulting Hub commit, so artifact_base_revision is the immutable measured pre-overlay tree.",
+    "Repository-head evidence does not prove the exact serving-process revision during a rolling deployment.",
+    "Reproducible build, binary provenance, and serving-process identity are not claimed.",
+    "No claim is made about private repositories or unobserved producer systems."
+  ]
+}