The Build track has levels L0 (none), L1 (provenance exists), L2 (signed provenance from a hosted build platform) and L3 (hardened build platform that prevents runs from influencing each other or forging provenance). Version 1.2 added a Source track (levels for version control, history, enforced controls and two-party review). Each level states what a verifier can trust and which threats it addresses.
SLSA provenance is an in-toto attestation with predicate type https://slsa.dev/provenance/v1, describing the builder, build type, external parameters and resolved dependencies. GitHub's artifact attestations, the slsa-github-generator, Google Cloud Build and npm provenance produce it; verifiers compare it against expectations such as the source repository and builder identity.