# title
Provene Aggregate Receipt Predicate v0.1

# description
Predicate body for predicateType https://provene.dev/attestation/code-change-aggregate/v0.1 (RFC 0001 section 9). Emitted by CI at merge or pull-request time, covering the constituent per-commit receipts. Unknown properties are permitted: verifiers must ignore fields they do not recognise.

# properties.attestation.description
An aggregate is produced by CI, which is the only party present when a merge result comes into existence. It is therefore never below T2.

# properties.attestation.properties.trustRoot.description
sigstore-github means the signer let GitHub select the instance by repository visibility: public-good Sigstore for public repositories, GitHub's private instance otherwise. Recorded as its own kind because the signer did not choose, and a verifier should not be told otherwise.

# properties.constituents.description
The per-commit receipts this aggregate carries forward, by digest. May be empty: a change with no receipts is a fact worth signing, not a reason to stay silent.

# properties.coverage.description
Emitted even when incomplete. A missing aggregate is indistinguishable from a crashed job or an uninstalled product; complete:false is a signed statement of exactly how much was covered.

# properties.verification.properties.runs.items.properties.observedBy.description
An aggregate is signed by CI, so every run it carries was observed by CI. A locally observed run cannot be promoted by restating it.