Bounded references to stable source identities and SHA-256 digests.
Provenance deliberately cannot contain examples, traces, prompts, reasoning, or arbitrary metadata. Those artifacts belong outside the playbook domain.
Summary
Functions
Builds a provenance reference set. Validation against policy occurs on admission.