diff --git a/Provenance.md b/Provenance.md
index e69de29..0e9c597 100644
--- a/Provenance.md
+++ b/Provenance.md
@@ -0,0 +1,30 @@
+# Provenance
+
+## Source Evidence
+
+- Gitea description: ESP32-P4 network auditing bridge workspace
+- Default branch: main
+- Detected language: C
+- Visibility: Private
+- Topics: firmware, hardware, private-workspace, readiness, stewarded
+- Local source inspected: /Volumes/sanD/dev_shit/p4-bridge
+- Visible project files beyond stewardship docs: 1193
+
+## Imported Or Generated Content Signals
+
+| Signal | Detail |
+|---|---|
+| CMakeLists.txt | CMake/ESP-IDF style build metadata is present. |
+| README files | README_IMPLEMENTATION.md, esp-idf/README.md, esp-idf/README_CN.md, esp-idf/components/README.md, esp-idf/docs/README.md, esp-idf/examples/README.md, include/README, lib/README, readme.md, sdcard/README.md, test/README |
+
+## Required Provenance Work
+
+- Identify upstream source, if any.
+- Preserve third-party license and notice files.
+- Record copied code, generated files, and binary artifacts separately.
+- Record build toolchain, source commit, and checksums for release assets.
+- Resolve `LICENSE_STATUS.md` before adding a final `LICENSE`.
+
+## Unknowns
+
+- No provenance unknowns were inferred from inspected evidence.