[ // AI AGENT & CLI BRIEF — curl -fsSL https://studio2201.com/install.sh | sh -s proven ]

Proven SLSA L3+ supply-chain attestor (`v0.2.11`). Signs reproducible builds with pure `std::` FIPS 204 ML-DSA-65 lattice signatures and SHA-256 AST Merkle roots · Agent & MCP Guide · Canary Testbed.

studio2201 / product 04 v0.2.11 Apache-2.0 SLSA Level 3+

Proven

PQC-signed supply-chain attestor. Reproducible builds with byte-identity hashing keyed on (host, rustc-version, Cargo.lock). Verification designed to survive the post-2030 quantum transition.

View on GitHub → Framework Doctrine →

What it does

ML-DSA-65 Digital Signatures

Signs artifacts using NIST FIPS 204 post-quantum lattice signatures, guaranteeing signatures cannot be forged by future quantum systems running Shor's algorithm.

SLSA Level 3+ Provenance

Generates non-falsifiable build provenance verifying artifacts match source trees byte-for-byte, preventing injection attacks like CVE-2024-3094 (XZ Utils).

AST Merkle Tree Root

Streams source files in 64 KiB chunks to compute a deterministic SHA-256 Merkle root, binding compiled binaries directly to verified source commits.

Air-Gappable & Zero Dependencies

Built purely in Rust standard library (std::). Validates provenance air-gapped without requiring calls to central transparency logs.

GitHub Actions & CI Enforcement

Verify artifact bit-reproducibility and attach post-quantum ML-DSA-65 attestations in CI.

# .github/workflows/proven.yml (Prompt your AI Agent or copy directly)
name: proven
on:
  push: { branches: [ master, main ] }
  pull_request: { branches: [ master, main ] }
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions: { contents: read }
jobs:
  proven:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: studio2201/studio2201@v1
        with: { tools: 'proven', fail-on: 'block' }
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: proven-report, path: proven_report.md, if-no-files-found: ignore }

# Workstation CLI installation (unprivileged, installs to ~/.local/bin):
curl -fsSL https://studio2201.com/install.sh | sh -s proven
proven attest --target target/release/app --key identity.pqc

Why This Matters & Authoritative Mandates

Cryptographic build integrity meeting NIST FIPS 204 (ML-DSA-65) and SLSA Level 3+ provenance standards.

OpenSSF SLSA v1.0 Spec ↗

Defines formal levels to prevent supply chain tampering. Level 3+ guarantees non-falsifiable provenance and hardened build environments.

NIST FIPS 204 (ML-DSA) ↗

Standardized Module-Lattice Digital Signature Standard finalized August 2024 to supersede classical RSA/ECDSA ahead of quantum decryption.

White House EO 14028 ↗

Executive Order on Improving the Nation's Cybersecurity mandating cryptographically verified software provenance across federal vendors.

in-toto Statement v1 ↗

Standardized attestation format binding subjects (binary hashes) to predicate metadata with verifiable cryptographic signatures.

How It Works Under the Hood

Pure std:: SHA-256

Processes binaries in 64 KiB chunks using a pure standard library SHA-256 implementation with zero external crates.

in-toto Envelope Generation

Constructs valid in-toto Statement v1 JSON encapsulating the artifact digest, builder identity, and AST Merkle root.

Deterministic Verification

proven verify recalculates the digest and validates the ML-DSA signature entirely offline with zero network latency.

Reproducible Build Guarantee

Verifies byte-identity keyed on compiler host, rustc version, and Cargo.lock across any CI/CD environment.