startup-credits

# Sourcey catalog

The public source of truth for Sourcey's open registry of startup programs.
Readable vendor inputs compile into immutable revisions and a deterministic,
content-addressed release consumed by sourcey.com, the API, feed, and MCP.
The same public package owns the provider-neutral Evidence Operations
application and durable local journal; hosted environments supply bounded
fetch, CAS, and review-proposal adapters without taking catalog authority.
Catalog also owns the public claim- and evidence-proposal contracts, offline
validators, and trusted operator commands that turn exact approved proposals
into purpose-separated protected objects. A provider adapter may open a
review, but only this boundary can materialize a pending authority bundle; the
release compiler remains the sole route into catalog truth and independently
re-verifies prospective identity, target trust, policy bytes, signatures, and
the complete proof graph.

OpenAPI and hosted MCP discovery are independent content-addressed contract
artifacts. They have separate definitions, versions, tags, release workflows,
and payload manifests; neither is bundled into the Read Runtime. Hosted
consumers pin the exact extracted artifacts and verify them against the runtime
registry before serving their bytes. Official MCP Registry publication is
idempotent at the immutable name/version boundary: the workflow reads the exact
provider record before any write, skips an already exact version, rejects
drift, and requires active/latest byte-identical provider readback after a new
or uncertain publish effect.

Internal executable artifacts are addressed by their bytes. The generated
packages are private GitHub release payloads, not npm products. Read Runtime,
Candidate Verifier, Claim Protocol, and Evidence Runtime each use their own
digest tag through one checked code-artifact publisher. The provider build
selects one purpose, double-builds its archive under the exact toolchain,
derives the tag and filename from the resulting digest, and points its
immutable tag at the exact Git commit. Runtime dependencies are exact and bundled inside each
archive, so a blank consumer can install with an empty npm cache and an
unreachable registry. The archive embeds its checked definition, exact build
toolchain, formally validated CycloneDX 1.6 SBOM, license policy, and
third-party notices. Its purpose release contains only the archive, checksum,
and keyless Sigstore bundle. Publication fails closed on provider lookup
failure, unexpected assets, or changed bytes, then downloads and compares the
exact release set before accepting provider readback.

The Evidence Operations bundle is configuration, not executable code. It is
published separately under a tag derived from its own `bundle_digest`; its
release metadata binds exact bytes, size, Git commit, and tree. It is never
embedded in Evidence Runtime or a catalog-data release.

The issued dogfood release is fictional and isolated under
`fixtures/dogfood/world/`. Production `data/` is a separate authority root.
The internal scanner reads thin URL inventories from `sources/` and retains
captures, normalized objects, provider effects, failures, and run journals
under ignored `.sourcey/` state. Its `proposed-authoring/` output already uses
the canonical vendor YAML shape but grants no authority.

Vendor submissions use a separate contributor-friendly intake and never
require scanner or issuer internals. Both lanes converge at offline evidence
verification, exact human review, purpose-scoped issuer authority, and the
shared `catalogctl prepare-pr` projector. That projector emits the exact
`startup-credits` repository tree with shared evidence objects stored once by
digest; release CI independently admits its proof graph and double-builds the
result. Site, public API v1, feed, and MCP consume only published release
bytes.

Capture is runtime composition: direct HTTP is followed by Internet Archive
by default, and future headless or import adapters implement the same port.
The plain source inventory and generic release manifest do not encode
providers. `npm run catalogctl -- quality --release <candidate-directory>`
reports semantic depth—structured eligibility, typed economics, lifecycle
diversity, corroboration, roles, and category coverage—separately from catalog
size.

An admitted merge to `main` is the complete human activation. The release
workflow derives its successor from the exact live publication, double-builds
and attests one immutable digest-addressed candidate, and publishes it. Hosted
custody automatically admits and signs those exact bytes, then projects the
same publication into sourcey.com, API v1, feed, MCP, and redirects. There is
no checked sequence/parent file, manual digest flag, consumer lock commit, or
second activation decision.

```sh
npm install
npm run verify
npm run catalogctl -- inspect --release dist/release
```

Repository boundaries and contribution rules are documented in
[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) and
[`docs/CONTRIBUTING.md`](docs/CONTRIBUTING.md).