Sourcey catalog

The public source of truth for Sourcey's open registry of startup programs. Readable vendor inputs compile into immutable revisions and a deterministic, content-addressed release consumed by sourcey.com, the API, feed, and MCP. The same public package owns the provider-neutral Evidence Operations application and durable local journal; hosted environments supply bounded fetch, CAS, and review-proposal adapters without taking catalog authority. Catalog also owns the public claim- and evidence-proposal contracts, offline validators, and trusted operator commands that turn exact approved proposals into purpose-separated protected objects. A provider adapter may open a review, but only this boundary can materialize a pending authority bundle; the release compiler remains the sole route into catalog truth and independently re-verifies prospective identity, target trust, policy bytes, signatures, and the complete proof graph.

OpenAPI and hosted MCP discovery are independent content-addressed contract artifacts. They have separate definitions, versions, tags, release workflows, and payload manifests; neither is bundled into the Read Runtime. Hosted consumers pin the exact extracted artifacts and verify them against the runtime registry before serving their bytes. Official MCP Registry publication is idempotent at the immutable name/version boundary: the workflow reads the exact provider record before any write, skips an already exact version, rejects drift, and requires active/latest byte-identical provider readback after a new or uncertain publish effect.

Internal executable artifacts are independently versioned by checked definitions under distributions/manifests/. The generated packages are private GitHub release payloads, not npm products. Read Runtime, Candidate Verifier, Claim Protocol, and Evidence Runtime each use their own purpose tag through one checked code-artifact publisher. Each lane double-builds its selected archive, binds the exact Git commit and tree, emits digest/integrity/source metadata, and refuses to assign an existing version to different bytes. The catalog-data v* workflow cannot publish any executable artifact or Evidence Operations bundle. Runtime dependencies are exact and bundled inside each archive, so a blank consumer can install with an empty npm cache and an unreachable registry. The archive embeds its checked definition, exact build toolchain, formally validated CycloneDX 1.6 SBOM, license policy, and third-party notices. Release metadata binds those bytes plus deterministic double-build and every-export smoke proof, and GitHub build provenance attests the complete immutable release set. Publication fails closed on provider lookup failure, unexpected assets, or changed bytes, then downloads and compares the exact release set before accepting provider readback. The same boundary owns catalog-data, OpenAPI, MCP, and Evidence Operations releases; contract artifacts have deterministic four-file sets and signed build provenance rather than operator-transcribed digests. Workflow YAML never defines release bytes: checked local builders double-produce the catalog candidate, Evidence Operations, OpenAPI, and MCP release sets and independently verify every payload/checksum pair before the shared provider effect can run.

The Evidence Operations bundle is configuration, not executable code. It is published separately under a tag derived from its own bundle_digest; its release metadata binds exact bytes, size, compatible catalog version, Git commit, and tree. It is never embedded in Evidence Runtime or a catalog-data release.

The issued dogfood release is fictional and isolated under fixtures/dogfood/world/. Production data/ is a separate authority root. Real first-party captures and AI-assisted extraction results are staged under datasets/live-offers/ for evidence review; the scanner cannot write either authority root or switch a release to real data. The corpus-review command rehashes the snapshot, local CAS, provider responses, compiled revisions, and coverage policy into a deterministic review packet. Human decisions approve authoring candidates only; they do not grant catalog authority. The editable worklist binds every immutable context field separately from disposition and reason. A separate execution-provenance document closes every reviewed record over its directly named harvest run, exact current run definition, and exact candidate journal. Accepted decisions export to a new recompiled candidate tree that is structurally unable to overlap production data/.

npm install
npm run verify
npm run catalogctl -- inspect --release dist/release

Repository boundaries and contribution rules are documented in docs/ARCHITECTURE.md and docs/CONTRIBUTING.md.