Knowledge sources map

Knowledge sources

A refresh run checks these sources again instead of finding them anew. Update this table whenever a source of the repository’s knowledge moves, appears or goes.

Each concept derived from a file or folder of this repository names it by its path from the repository root, in resource and in sources. knowledge-report.sh worklist lists the concepts whose source moved since their stamp. It never fetches a page, so re-read the external pages this table names when the schema header’s version or the upstream pins move.

Source	Yields	Re-check by
src/cis_controls/schema/cis_controls.yaml	datasets/cis-controls-linkml-schema, the five glossary/ terms	re-read the header’s version, source, annotations and comments, each class’s required slots, the patterns, the enums and the mappings
src/cis_controls/data/cis-controls-8.1.2.yaml	datasets/edition-file, the 18 controls/ concepts	re-read each Control’s title and description, and re-count each Control’s Safeguards and Implementation Groups
project.justfile, .lokf/cis-controls.yaml, .lokf/justfile, .lokf/pyproject.toml, the README’s Knowledge Trust Ladder (KTL) section	the domain-schema section of datasets/cis-controls-linkml-schema	re-read the --root list, the copy’s notes, the schema := line and the [tool.lokf] table
scripts/check_upstream_release.py, .github/scripts/	playbooks/update-upstream-pins, workflows/upstream-watch	re-read the pins, the docstring and the issue title
README.md (What it models, Influences, Mappings, Not modelled here), docs/about.md, .linkmllint.yaml, CHANGELOG.md	explanations/scope-and-influences, explanations/element-names	re-read each section and the lint comment
justfile, .linkml/generators.yaml, project/, src/cis_controls/datamodel/, docs/schema/, docs/elements/, .pre-commit-config.yaml	datasets/generated-artefacts	re-read the gen-project, gen-doc and test recipes and the excludes; re-list project/*/
tests/	datasets/test-data	re-count valid/ and invalid/; re-read the tests, the stubbed watch tests and the neighbours’ checksums
the Validating data section of docs/index.md	playbooks/validate-data	re-read the section
CONTRIBUTING.md, the lint, gen-project, gen-doc and test recipes	playbooks/regenerate-and-test	confirm the setup, the checklist and the recipes
.releaserc.json, .github/scripts/changelog-release.mjs, CHANGELOG.md, the Releasing section of CONTRIBUTING.md	playbooks/release	re-read the release rules, the commands and the baseline paragraph
the nine files in .github/workflows/	the nine workflows/ concepts	re-read each file’s on keys, its jobs’ permissions and environments, and the variables and secrets it reads
.github/release/	workflows/semantic-release	re-read package.json and the versions the lockfile pins
website/	services/documentation-site	re-read site.config.mjs and website/README.md
NOTICE, LICENSE, website/NOTICE, the License section of README.md	policies/license-and-attribution	re-read each third-party entry
SECURITY.md, .github/dependabot.yml	policies/security-policy	re-read the table of surfaces and the settings not yet in force
AI_COVENANT.md	policies/ai-covenant	re-read the project note and the section on agent automation
https://www.cisecurity.org/controls/v8-1, the guide it offers at v8.1.2	references/cis-controls-guide, the 18 controls/ concepts, glossary/asset-class, glossary/security-function	the guide asks for a registration; re-read it when the upstream watch reports a new version
https://www.cisecurity.org/controls/cis-controls-list, https://www.cisecurity.org/controls/implementation-groups and its three group pages, https://www.cisecurity.org/insights/white-papers/guide-to-asset-classes-cis-critical-security-controls-v8-1	references/cis-controls-site, glossary/control, glossary/safeguard, glossary/implementation-group	external pages, read on 2026-10-30; re-read them when the upstream watch reports a new version

The paths under exclusions were looked at and left out, each for the reason it gives. They are governance text, tooling settings, template text, package plumbing, the pointer for agents, and the sidecar’s files. Some of the sidecar’s files are sources even so: the domain schema, the justfile’s schema := line and the [tool.lokf] table.

No concept here quotes CIS’s guide. The Controls are named by number and by the edition file’s titles, and the bundle’s descriptions are its own words, because CIS licenses the guide under CC BY-NC-ND 4.0.