Part 3: Provenance Is a Byproduct, Not a Project

Once app, config, weights, and tools are digest-addressed artifacts with attestations attached, much of the evidence the 2026-2027 EU obligation stack asks for becomes a query against infrastructure that already exists — not a compliance pipeline someone builds. The registry is the evidence trail; it is never the judgment that the trail was adequate.