# **DSAC Provenance Record Technical Standard**

## **1\. Introduction**

This standard specifies the required JSON structure for the Digital Signature and Audit Chain (DSAC) Provenance Record. Adherence to this standard is mandatory for all system components and automated tools involved in artifact hashing, signing, and verification within The Partnership Covenant.

## **2\. Record Structure (JSON Schema)**

The DSAC Provenance Record is a single, flat JSON object.

| Field Name | Type | Required | Description |
| :---- | :---- | :---- | :---- |
| record\_id | String | YES | Unique, immutable identifier for this specific record instance (e.g., a timestamp concatenated with a random ID). |
| timestamp\_utc | String | YES | The date and time (ISO 8601 format, UTC) when this record was generated and signed. |
| artifact\_filepath | String | YES | The relative path to the file this record verifies (e.g., 01\_CHARTER\_AGREEMENT/charter.md). |
| artifact\_version | String | YES | The version number of the artifact as defined by the Artifact Owner (e.g., v1.0.3). |
| artifact\_hash\_sha256 | String | YES | The SHA-256 hash of the complete artifact file content at the time of signing. |
| signer\_key\_id | String | YES | The public key ID used to generate the cryptographic signature (digital\_signature). |
| digital\_signature | String | YES | The cryptographic signature of the entire JSON object (excluding this field, which is added last) generated by the Signer’s private key. |
| lifecycle\_stage | Enum | YES | The reason for this record generation (e.g., MAJOR\_REVISION, INITIAL\_CREATION, STEWARDSHIP\_CHANGE). |
| description | String | YES | A concise explanation of the change that triggered this record generation. |

## **3\. Context Object (Conditional)**

The optional context object is used to link the record to internal governance processes.

| Field Name | Type | Required | Description |
| :---- | :---- | :---- | :---- |
| context.governance\_log\_entry | String | NO | Reference ID for the formal entry in the Governance Log that authorized the change. |
| context.change\_owner\_id | String | NO | Identifier of the individual or team responsible for the content change. |
| context.previous\_record\_id | String | NO | The record\_id of the immediate predecessor Provenance Record. |

## **4\. Hashing and Signing Protocol**

1. **Hashing Target:** The artifact\_hash\_sha256 field must be generated from the raw, byte-for-byte content of the file specified in artifact\_filepath.  
2. Signature Target: The digital\_signature must be generated by:  
   a. Hashing the entire JSON record object (with the digital\_signature field temporarily set to null).  
   b. Signing that hash using the authorized private key identified by signer\_key\_id.  
   c. Placing the resulting signature into the digital\_signature field.