Knowledge sources map

Steady-state refresh runs re-verify these sources instead of discovering them again. Update this map whenever the repository’s knowledge geography changes.

Each concept derived from a file or folder of this repository names it by its path from the repository root, in resource and in sources. knowledge-report.sh worklist lists the concepts whose source moved since their stamp. It never fetches a page, so re-read the external pages this table names when the pins move.

Source	Yields	Re-check by
src/attack/schema/attack.yaml	datasets/attack-linkml-schema, the twelve glossary/ terms	re-read the header’s version, source, annotations and comments, each class’s required slots, the patterns, the enums and the rules
src/attack/schema/stix/, tests/test_stix_import.py	datasets/stix-modules, references/lmodel-stix	re-read the pinned commit and hashes
project.justfile, .lokf/attack.yaml, .lokf/justfile, .lokf/pyproject.toml	the domain-schema section of datasets/attack-linkml-schema	re-read the --root list and --prefix, the copy’s notes, the schema := line and the [tool.lokf] table
tests/data/attack-stix-data/, scripts/fetch_attack_data.py	datasets/pinned-attack-bundles, references/attack-stix-data	re-read the manifest’s pins and the fetch script’s docstring
scripts/check_upstream_release.py, .github/scripts/	playbooks/update-upstream-pins, workflows/upstream-watch, references/attack-data-model	re-read the pins, the docstring and the issue title
tests/	datasets/test-data, explanations/data-departures	re-count valid/, invalid/ and the extract; re-read KNOWN_DEPARTURES and the neighbours’ checksums
README.md, docs/about.md, .linkmllint.yaml, CHANGELOG.md	explanations/scope-and-influences, explanations/element-names	re-read each section and the lint comment
justfile, .linkml/generators.yaml, project/, src/attack/datamodel/, docs/schema/	datasets/generated-artefacts	re-read the recipes and the jsonschema settings; re-list project/
the Validating data section of docs/index.md	playbooks/validate-data	re-read the section
CONTRIBUTING.md	playbooks/regenerate-and-test	confirm the setup and the checklist
.releaserc.json, .github/release/, the Releasing section of CONTRIBUTING.md	playbooks/release, workflows/semantic-release	re-read the release rules, the commands and the pinned tools
the nine files in .github/workflows/	the nine workflows/ concepts	re-read each file’s on keys, its jobs’ permissions and environments, and the variables and secrets it reads
website/	services/documentation-site	re-read site.config.mjs and website/README.md
NOTICE, LICENSE, website/NOTICE, the License section of README.md	policies/license-and-attribution	re-read each third-party entry
SECURITY.md, .github/dependabot.yml	policies/security-policy	re-read the table of surfaces and the settings not yet in force
AI_COVENANT.md	policies/ai-covenant	re-read the project note and the section on agent automation
https://github.com/mitre-attack/attack-stix-data/releases/tag/v20.0, https://attack.mitre.org/resources/versions/	references/attack-stix-data	external pages, read on 2026-10-31; re-read them when the upstream watch reports a new release
https://github.com/mitre-attack/attack-data-model/releases/tag/v4.11.7, https://mitre-attack.github.io/attack-data-model/schemas/	references/attack-data-model, the glossary’s definedBy	external pages, read on 2026-10-31; re-read them when the watch reports a new ADM release

The paths under exclusions were looked at and left out, each for the reason it gives: governance text, tooling settings, template text, package plumbing, the pointer for agents, and the sidecar’s own files. Of the sidecar’s files, the domain schema, the justfile’s schema := line and the [tool.lokf] table are sources.