archctx 0.1.3 → 0.1.4-beta.0

package/assets/practices/security.least-privilege.yaml

@@ -0,0 +1,70 @@
+{
+  "schemaVersion": "archcontext.practice/v1",
+  "id": "security.least-privilege",
+  "revision": 1,
+  "status": "active",
+  "title": "New credentials and integration scopes must be least-privilege",
+  "summary": "When a change adds credentials, tokens, cloud permissions, or integration scopes, the allowed operations must be narrower than the integration's full capability set.",
+  "category": "security",
+  "tags": ["security", "permissions", "credentials"],
+  "appliesTo": {
+    "repositoryKinds": ["application", "service"],
+    "languages": [],
+    "frameworks": [],
+    "pathGlobs": ["src/**", "packages/**", "deploy/**", ".github/**"],
+    "nodeKinds": ["service", "resource", "policy"],
+    "negativePathGlobs": ["test/**", "docs/**"]
+  },
+  "triggers": {
+    "candidateTerms": ["token", "credential", "permission", "scope", "secret", "key"],
+    "pressureSignals": ["broad-permission-scope"],
+    "structuralPredicates": ["new-credential-scope-observed", "permission-expanded"]
+  },
+  "evidencePolicy": {
+    "minimumStrengthForRecommendation": "heuristic",
+    "minimumStrengthForCheckpoint": "observed",
+    "minimumStrengthForEnforcement": "observed",
+    "requiredKindsForEnforcement": ["diff", "path"],
+    "maxEnforcementWhenOnlyHeuristic": "advisory"
+  },
+  "guidance": {
+    "questions": ["What operation does this credential need?", "Which permissions are explicitly forbidden?", "Where is rotation or revocation handled?"],
+    "preferred": ["Use named, narrow scopes.", "Keep secret material out of repository and logs."],
+    "avoid": ["Granting broad platform permissions for one API call.", "Persisting secret values in architecture or verification artifacts."]
+  },
+  "checks": [
+    {
+      "checkId": "least-privilege-required",
+      "mode": "deterministic",
+      "parameters": {
+        "forNewCredentialScopes": true
+      }
+    }
+  ],
+  "enforcement": {
+    "default": "advisory",
+    "promotableTo": "complete",
+    "repoOptInRequired": true,
+    "fixtureGate": {
+      "positive": [{ "id": "fixture.security.least-privilege.positive", "path": "evals/practices/enforcement-waiver-adversarial.jsonl", "description": "Security-sensitive permission expansion can be complete-gated only with explicit scoped evidence." }],
+      "nearNegative": [{ "id": "fixture.security.least-privilege.near-negative", "path": "evals/practices/benign-negative.jsonl", "description": "Benign security wording remains non-gating." }],
+      "mixedChange": [{ "id": "fixture.security.least-privilege.mixed-change", "path": "packages/core/practice-engine/test/practice-engine.test.ts", "description": "Bound evidence tests prevent unrelated observed evidence from promoting security practice matches." }],
+      "baseline": [{ "id": "fixture.security.least-privilege.baseline", "path": "packages/core/practice-engine/test/practice-engine.test.ts", "description": "Typed practice bindings anchor security evidence to the expected baseline subject." }]
+    }
+  },
+  "provenance": {
+    "sourceKind": "archcontext-native",
+    "sourceRefs": [
+      {
+        "sourceId": "archcontext.adr.0036"
+      }
+    ],
+    "curator": "archcontext-maintainers",
+    "reviewedAt": "2026-06-23"
+  },
+  "lifecycle": {
+    "introducedAt": "2026-06-23",
+    "reviewAfter": "2027-06-23",
+    "supersedes": []
+  }
+}

package/assets/practices/supply-chain.pinned-dependencies.yaml

@@ -0,0 +1,65 @@
+{
+  "schemaVersion": "archcontext.practice/v1",
+  "id": "supply-chain.pinned-dependencies",
+  "revision": 1,
+  "status": "active",
+  "title": "Runtime dependency changes should be pinned and reviewable",
+  "summary": "A dependency introduced into the runtime path should be pinned through the package manager lockfile or an equivalent deterministic manifest.",
+  "category": "supply-chain",
+  "tags": ["supply-chain", "dependencies", "lockfile"],
+  "appliesTo": {
+    "repositoryKinds": ["application", "service", "library"],
+    "languages": [],
+    "frameworks": [],
+    "pathGlobs": ["package.json", "bun.lock", "pnpm-lock.yaml", "package-lock.json", "Cargo.toml", "go.mod"],
+    "nodeKinds": ["package", "module"],
+    "negativePathGlobs": ["docs/**", "test/**"]
+  },
+  "triggers": {
+    "candidateTerms": ["dependency", "package", "lockfile", "version"],
+    "pressureSignals": ["unpinned-runtime-dependency"],
+    "structuralPredicates": ["runtime-dependency-added", "lockfile-not-updated"]
+  },
+  "evidencePolicy": {
+    "minimumStrengthForRecommendation": "observed",
+    "minimumStrengthForCheckpoint": "observed",
+    "minimumStrengthForEnforcement": "observed",
+    "requiredKindsForEnforcement": ["package-manifest", "diff"],
+    "maxEnforcementWhenOnlyHeuristic": "advisory"
+  },
+  "guidance": {
+    "questions": ["Which runtime path uses this dependency?", "Where is the resolved version pinned?", "What rollback removes the dependency safely?"],
+    "preferred": ["Commit lockfile changes with manifest changes.", "Keep optional providers out of mandatory local-core paths."],
+    "avoid": ["Adding a runtime dependency without lockfile evidence.", "Letting optional network providers become implicit required dependencies."]
+  },
+  "checks": [
+    {
+      "checkId": "pinned-dependencies-required",
+      "mode": "deterministic",
+      "parameters": {
+        "requireLockfileEvidence": true
+      }
+    }
+  ],
+  "enforcement": {
+    "default": "advisory",
+    "promotableTo": "checkpoint",
+    "repoOptInRequired": true
+  },
+  "provenance": {
+    "sourceKind": "curated-open-source",
+    "sourceRefs": [
+      {
+        "sourceId": "openssf.scorecard",
+        "licenseSpdx": "Apache-2.0"
+      }
+    ],
+    "curator": "archcontext-maintainers",
+    "reviewedAt": "2026-06-23"
+  },
+  "lifecycle": {
+    "introducedAt": "2026-06-23",
+    "reviewAfter": "2027-06-23",
+    "supersedes": []
+  }
+}

package/assets/profiles/s6.yaml

@@ -0,0 +1,194 @@
+[
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.generic-service",
+    "revision": 1,
+    "status": "active",
+    "title": "Generic Service",
+    "repositoryKinds": ["service", "application"],
+    "languages": [],
+    "frameworks": [],
+    "includePracticeIds": [
+      "api.contract-before-implementation",
+      "api.schema-version-contract",
+      "observability.release-health-probe",
+      "ownership.service-catalog-entry",
+      "security.external-permission-review"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.spec" }, { "sourceId": "backstage" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.library",
+    "revision": 1,
+    "status": "active",
+    "title": "Reusable Library",
+    "repositoryKinds": ["library"],
+    "languages": [],
+    "frameworks": [],
+    "includePracticeIds": [
+      "api.contract-before-implementation",
+      "api.backward-compatible-error-shape",
+      "modularity.layer-contract-declared",
+      "supply-chain.release-artifact-digest",
+      "decision.tradeoff-options-recorded"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.spec" }, { "sourceId": "madr" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.typescript",
+    "revision": 1,
+    "status": "active",
+    "title": "TypeScript Project",
+    "repositoryKinds": ["application", "service", "library"],
+    "languages": ["typescript"],
+    "frameworks": [],
+    "includePracticeIds": [
+      "api.schema-version-contract",
+      "modularity.no-shared-internal-imports",
+      "supply-chain.dependency-update-review",
+      "security.audit-log-redaction",
+      "data.event-version-lineage"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.spec" }, { "sourceId": "openssf.scorecard" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.java",
+    "revision": 1,
+    "status": "active",
+    "title": "Java Project",
+    "repositoryKinds": ["application", "service", "library"],
+    "languages": ["java"],
+    "frameworks": [],
+    "includePracticeIds": [
+      "modularity.respect-dependency-direction",
+      "modularity.layer-contract-declared",
+      "modularity.no-shared-internal-imports",
+      "api.idempotency-contract",
+      "data.schema-ownership-boundary"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "curated-reference",
+      "sourceRefs": [{ "sourceId": "archunit" }, { "sourceId": "archcontext.spec" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.kubernetes",
+    "revision": 1,
+    "status": "active",
+    "title": "Kubernetes Service",
+    "repositoryKinds": ["service", "application"],
+    "languages": [],
+    "frameworks": ["kubernetes"],
+    "includePracticeIds": [
+      "observability.release-health-probe",
+      "observability.error-budget-signal",
+      "ownership.escalation-contact",
+      "compatibility.rollback-entrypoint",
+      "supply-chain.sbom-manifest"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "curated-reference",
+      "sourceRefs": [{ "sourceId": "kubernetes.docs" }, { "sourceId": "opentelemetry" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.event-driven",
+    "revision": 1,
+    "status": "active",
+    "title": "Event Driven Service",
+    "repositoryKinds": ["service", "application"],
+    "languages": [],
+    "frameworks": [],
+    "includePracticeIds": [
+      "api.idempotency-contract",
+      "data.event-version-lineage",
+      "observability.queue-boundary-metrics",
+      "migration.parallel-run-observability",
+      "compatibility.deprecation-window"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.adr.0009" }, { "sourceId": "opentelemetry" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.monorepo",
+    "revision": 1,
+    "status": "active",
+    "title": "Monorepo",
+    "repositoryKinds": ["application", "service", "library"],
+    "languages": [],
+    "frameworks": [],
+    "includePracticeIds": [
+      "modularity.no-new-cycle",
+      "modularity.no-shared-internal-imports",
+      "ownership.operational-owner",
+      "supply-chain.dependency-update-review",
+      "decision.supersession-link"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.spec" }, { "sourceId": "backstage" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-profile/v1",
+    "id": "profile.security-sensitive",
+    "revision": 1,
+    "status": "active",
+    "title": "Security Sensitive Repository",
+    "repositoryKinds": ["application", "service", "library"],
+    "languages": [],
+    "frameworks": [],
+    "includePracticeIds": [
+      "security.least-privilege",
+      "security.secret-material-never-enters-repo",
+      "security.audit-log-redaction",
+      "security.external-permission-review",
+      "supply-chain.release-artifact-digest"
+    ],
+    "excludePracticeIds": [],
+    "provenance": {
+      "sourceKind": "archcontext-native",
+      "sourceRefs": [{ "sourceId": "archcontext.adr.0036" }, { "sourceId": "openssf.scorecard" }],
+      "curator": "archcontext-maintainers",
+      "reviewedAt": "2026-06-24"
+    }
+  }
+]

package/assets/sources/core.yaml

@@ -0,0 +1,211 @@
+[
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.spec",
+    "name": "ArchContext Product Specification",
+    "sourceType": "archcontext",
+    "uri": "docs/spec.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000001",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.adr.0008",
+    "name": "ADR-0008 Declared Observed Verified",
+    "sourceType": "archcontext",
+    "uri": "docs/adr/ADR-0008-declared-observed-verified.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000008",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.adr.0009",
+    "name": "ADR-0009 Target State vs Migration State",
+    "sourceType": "archcontext",
+    "uri": "docs/adr/ADR-0009-target-state-vs-migration-state.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000009",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.adr.0010",
+    "name": "ADR-0010 Compatibility Code Requires Contract",
+    "sourceType": "archcontext",
+    "uri": "docs/adr/ADR-0010-compatibility-code-requires-contract.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000010",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.adr.0012",
+    "name": "ADR-0012 Changeset-only Architecture Writes",
+    "sourceType": "archcontext",
+    "uri": "docs/adr/ADR-0012-changeset-only-architecture-writes.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000012",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archcontext.adr.0036",
+    "name": "ADR-0036 Deterministic Gate LLM Advisory",
+    "sourceType": "archcontext",
+    "uri": "docs/adr/ADR-0036-deterministic-gate-llm-advisory.md",
+    "revision": "2026-06-23",
+    "licenseSpdx": "LicenseRef-ArchContext-Repo",
+    "licenseLevel": "A",
+    "usagePolicy": "repo-authored",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:1000000000000000000000000000000000000000000000000000000000000036",
+    "attribution": "ArchContext maintainers",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "madr",
+    "name": "Markdown Architectural Decision Records",
+    "sourceType": "git",
+    "uri": "https://github.com/adr/madr",
+    "revision": "v4.0.0",
+    "licenseSpdx": "MIT OR CC0-1.0",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000001",
+    "attribution": "MADR contributors",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "backstage",
+    "name": "Backstage Software Catalog",
+    "sourceType": "git",
+    "uri": "https://github.com/backstage/backstage",
+    "revision": "pinned-reference",
+    "licenseSpdx": "Apache-2.0",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000002",
+    "attribution": "Backstage contributors",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "archunit",
+    "name": "ArchUnit",
+    "sourceType": "git",
+    "uri": "https://github.com/TNG/ArchUnit",
+    "revision": "pinned-reference",
+    "licenseSpdx": "Apache-2.0",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000003",
+    "attribution": "ArchUnit contributors",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "opentelemetry",
+    "name": "OpenTelemetry Documentation",
+    "sourceType": "git",
+    "uri": "https://github.com/open-telemetry/opentelemetry.io",
+    "revision": "pinned-reference",
+    "licenseSpdx": "CC-BY-4.0",
+    "licenseLevel": "B",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000004",
+    "attribution": "OpenTelemetry contributors",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "openssf.scorecard",
+    "name": "OpenSSF Scorecard",
+    "sourceType": "git",
+    "uri": "https://github.com/ossf/scorecard",
+    "revision": "pinned-reference",
+    "licenseSpdx": "Apache-2.0",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-23T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000005",
+    "attribution": "OpenSSF Scorecard contributors",
+    "review": {
+      "status": "approved",
+      "reviewer": "archcontext-maintainers",
+      "reviewedAt": "2026-06-23"
+    }
+  }
+]

package/assets/sources/s6.yaml

@@ -0,0 +1,122 @@
+[
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "structurizr.dsl",
+    "name": "Structurizr DSL Documentation",
+    "sourceType": "website",
+    "uri": "https://docs.structurizr.com/dsl",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "LicenseRef-Structurizr-Docs",
+    "licenseLevel": "B",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000006",
+    "attribution": "Structurizr DSL documentation",
+    "review": { "status": "approved", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "twelve-factor",
+    "name": "The Twelve-Factor App",
+    "sourceType": "git",
+    "uri": "https://github.com/heroku/12factor",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "MIT",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000007",
+    "attribution": "The Twelve-Factor App contributors",
+    "review": { "status": "approved", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "kubernetes.docs",
+    "name": "Kubernetes Documentation",
+    "sourceType": "git",
+    "uri": "https://github.com/kubernetes/website",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "CC-BY-4.0",
+    "licenseLevel": "B",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000008",
+    "attribution": "Kubernetes documentation contributors",
+    "review": { "status": "approved", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "cncf.app-delivery",
+    "name": "CNCF TAG App Delivery",
+    "sourceType": "git",
+    "uri": "https://github.com/cncf/tag-app-delivery",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "Apache-2.0",
+    "licenseLevel": "A",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000009",
+    "attribution": "CNCF TAG App Delivery contributors",
+    "review": { "status": "approved", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "google.sre",
+    "name": "Google SRE Book",
+    "sourceType": "website",
+    "uri": "https://sre.google/sre-book/table-of-contents/",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "CC-BY-NC-ND-4.0",
+    "licenseLevel": "C",
+    "usagePolicy": "reference-only",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000010",
+    "attribution": "Google SRE Book authors",
+    "review": { "status": "reference-only", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "azure.architecture",
+    "name": "Azure Architecture Center",
+    "sourceType": "website",
+    "uri": "https://learn.microsoft.com/azure/architecture/",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "LicenseRef-Microsoft-Docs",
+    "licenseLevel": "B",
+    "usagePolicy": "builtin-with-attribution",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000011",
+    "attribution": "Microsoft Learn documentation",
+    "review": { "status": "approved", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "owasp.cheat-sheet-series",
+    "name": "OWASP Cheat Sheet Series",
+    "sourceType": "git",
+    "uri": "https://github.com/OWASP/CheatSheetSeries",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "CC-BY-SA-4.0",
+    "licenseLevel": "C",
+    "usagePolicy": "reference-only",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000012",
+    "attribution": "OWASP Cheat Sheet Series contributors",
+    "review": { "status": "reference-only", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  },
+  {
+    "schemaVersion": "archcontext.practice-source/v1",
+    "id": "arc42",
+    "name": "arc42 Template",
+    "sourceType": "website",
+    "uri": "https://arc42.org/",
+    "revision": "pinned-reference-2026-06-24",
+    "licenseSpdx": "CC-BY-SA-4.0",
+    "licenseLevel": "C",
+    "usagePolicy": "reference-only",
+    "retrievedAt": "2026-06-24T00:00:00Z",
+    "contentDigest": "sha256:2000000000000000000000000000000000000000000000000000000000000013",
+    "attribution": "arc42 contributors",
+    "review": { "status": "reference-only", "reviewer": "archcontext-maintainers", "reviewedAt": "2026-06-24" }
+  }
+]