{
  "markdown": "# Software Supply Chain Landscape\n\nCurated, sourced knowledge about the software supply chain — bills of materials, provenance,\nattestation, vulnerability intelligence, licensing and the tooling around them.\n\nDistributed as an [OKF](https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md)\nbundle: one concept per markdown file, YAML frontmatter, no tooling required to read it.\n\n## Start here\n\n**[knowledge/landscape.md](knowledge/landscape.md)** is the map — written to be read straight\nthrough once, so the individual specifications make sense when you meet them later. Everything else\nis looked *up* rather than read.\n\nThen [knowledge/index.md](knowledge/index.md) for the concept listing.\n\n## What makes this different from a wiki\n\nEvery concept states where its facts came from, who checked them, and when they expire.\n\n| Frontmatter | What it records |\n|---|---|\n| `sources` | the specific pages a concept draws on, each with an `id` |\n| footnotes | per-claim attribution — `[^cdx-cbom]` keys into `sources[].id` |\n| `verified` | confirmation events; absent means **nobody has checked this** |\n| `stale_after` | when the concept stops being trustworthy |\n\nA footnote whose label is not a `sources[].id` attributes nothing, and a concept past its\n`stale_after` fails a gate. Both are **enforced by a checker, not asked for in prose** — run on\nevery commit, and again weekly on a schedule. The weekly run is the one that matters for expiry:\na concept goes stale with the calendar, on a repository nobody has touched.\n\nThat discipline came from being burned: an earlier version of this corpus cited project homepages\nfor claims that needed specific pages, and one URL had been written from memory.\n\n## Layout\n\n```\nknowledge/          the OKF bundle — everything this repository carries\n  landscape.md      the explanation; type: Explanation\n  index.md          concept listing, for progressive disclosure\n  log.md            what changed in the bundle, and when\n  bom-types/ naming/ formats/ licensing/\n  intelligence/ provenance/ distribution/ tools/\n```\n\nKnowledge and nothing else. Tooling and decision records live in the meta-project this was\nextracted from.\n\n## Reading it as an agent\n\nThe bundle is designed for grounding. `index.md` files exist for progressive disclosure — read\nthose to decide what to load, rather than loading the tree. Concepts cross-link with bundle-relative\npaths (`/naming/purl.md`), which are interpreted from `knowledge/`.\n\nTreat `verified: absent` as unverified. Most of this corpus is migrated prose whose claims have not\nbeen re-checked; the concepts that *have* been checked say so.\n\n## Licence\n\n**[CC BY 4.0](LICENSES/CC-BY-4.0.txt)** — use it, quote it, build on it, with attribution.\n\nDeclared per-file in [`REUSE.toml`](REUSE.toml) and enforced by `reuse lint`.\n\nFacts drawn from upstream sources remain theirs; each concept names them. The upstream set is\npermissively licensed throughout — Apache-2.0, CC0-1.0, and US government works — with no\nshare-alike obligation.\n",
  "bytes": 3039,
  "sha": "df39f64e46de37c46d332c4e590ab0b4fdea9a02a45579c49102c6a2baa56c12",
  "repo_slug": "jrjsmrtn/software-supply-chain-landscape",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_jrjsmrtn_software_supply_chain_landscape_cdfc3d6f/readme"
}