Summary
On a repository that has never been attested (no refs/notes/commits ref), both status and the attest flow hard-error instead of treating the missing ref as "no prior attestations":
Error: ... attempting to read provenance from commit "...": fetching attestations:
fetch throttler error: error cloning repositories: reading
"git+https://github.com/ORG/REPO@refs/notes/commits#..":
fetching ref "refs/notes/commits": couldn't find remote ref "refs/notes/commits"
So the genesis attestation — the one that would create the ref — can never be produced. Chicken-and-egg: onboarding a fresh repo is impossible without out-of-band surgery.
Workaround we used
Manually seed the ref once:
git notes add -m "seed" HEAD
git push origin refs/notes/commits
after which everything flows (first run logs "No provenance attestation found" and proceeds correctly).
Suggested fix
Treat "remote ref not found" for the notes ref as an empty attestation set rather than an error, in the notes fetcher path.
Summary
On a repository that has never been attested (no
refs/notes/commitsref), bothstatusand the attest flow hard-error instead of treating the missing ref as "no prior attestations":So the genesis attestation — the one that would create the ref — can never be produced. Chicken-and-egg: onboarding a fresh repo is impossible without out-of-band surgery.
Workaround we used
Manually seed the ref once:
after which everything flows (first run logs "No provenance attestation found" and proceeds correctly).
Suggested fix
Treat "remote ref not found" for the notes ref as an empty attestation set rather than an error, in the notes fetcher path.