Enforce source-time provenance across ingest

README.md

@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"time"
 
 	attesto "git.rotz.ai/rotzmediagroup/attesto-v1/sdk/go"
 )
@@ -43,7 +44,8 @@ func main() {
 	}
 
 	receipt, err := client.LogEvent(ctx, stream.StreamID, attesto.EventInput{
-		SourceRef: "decision-42",
+		SourceRef:  "decision-42",
+		OccurredAt: time.Now().UTC().Format(time.RFC3339Nano),
 		Payload: attesto.M{
 			"model": "risk-classifier",
 			"score": 0.92,
@@ -53,10 +55,15 @@ func main() {
 		log.Fatal(err)
 	}
 
-	fmt.Println(receipt.StreamEventID, receipt.EventHash)
+fmt.Println(receipt.StreamEventID, receipt.EventHash)
 }
 ```
 
+Attesto stores source-system time separately from backend ingest time.
+`OccurredAt` must be RFC3339 with a timezone offset. The Go SDK fills it with
+`time.Now().UTC()` when omitted, but production integrations should pass the
+real upstream event timestamp whenever the source system provides one.
+
 ## Verification
 
 Remote verification uses Attesto's public `/v2/verify` API. Offline receipt