What changed in the knowledge bundle, a day to an entry, newest first. https://w3id.org/lmodel/slsa/knowledge/log 2026-10-30T23:30:45Z Noel McLoughlin CC BY 4.0 https://w3id.org/lmodel/slsa/knowledge/log#2026-10-30 2026-10-30T23:30:45Z 2026-10-30T23:30:45Z <ul> <li><strong>Prose</strong>: reworded 5 concept bodies in plain English. No fact, link, number or frontmatter changed.</li> <li><strong>Changed</strong>: the schema concept says that each <code>slsa_*</code> module imports the core, as the line under the module table of <code>src/slsa/schema/README.md</code> now does.</li> <li><strong>Changed</strong>: the generated artifacts say that a release compares the justfile's <code>schema :=</code> line and the schema's files as well as the bundle, and how the schema asset is packed and attested, as <code>knowledge-release.yaml</code> has said since 23442fd.</li> <li><strong>Changed</strong>: the documentation site says that a push builds the site only on the default branch and that a run by hand builds it too, as <code>knowledge-website.yaml</code> says, and names the Guides group that <code>site.config.mjs</code> puts the docs pages in.</li> <li><strong>Changed</strong>: the schema concept follows the corrected naming paragraph of <code>docs/about.md</code>, which puts the in-toto layer under <code>in_toto_linkml:</code>, and the module table of <code>src/slsa/schema/README.md</code>, which now lists the vendored in-toto module.</li> <li><strong>Changed</strong>: the specification page quotes the overview at <code>https://slsa.dev/spec/v1.2/</code>, which says that the specification is established by industry consensus and organized into a series of levels.</li> <li><strong>Changed</strong>: the source map names the release's comparison step beside its domain-schema step, and no longer lists <code>knowledge-website.yaml</code> among the workflows it leaves out.</li> <li><strong>Rewrite</strong>: the in-toto page says that the schema takes the in-toto layer from lmodel/in-toto's core module at v0.1.0, vendored unchanged and pinned by <code>tests/test_in_toto_import.py</code>, and names <code>InTotoPredicate</code>, the three field types and the module's IRIs.</li> <li><strong>Rewrite</strong>: the schema concept follows the in-toto import: <code>slsa_core.yaml</code> imports lmodel/in-toto's vendored core module and adds <code>SlsaStatement</code>, the modules hold 42 classes and 4 types, six SLSA fields take in-toto's types, and the adapt copy renames a statement's <code>predicate</code> to <code>slsa_predicate</code>, as the README now says.</li> <li><strong>Rewrite</strong>: the test data concept counts 32 valid and 36 invalid files, names the renamed <code>SlsaStatement</code> examples, and adds the counter-examples for a start time with an offset and a verifier id with an uppercase host.</li> <li><strong>Changed</strong>: the whitepaper page puts <code>signing_tool</code> and <code>transparency_log_entry</code> on <code>SlsaStatement</code>, as <code>docs/about.md</code> now does.</li> <li><strong>Changed</strong>: the specification page says that the in-toto statement layer comes from lmodel/in-toto's vendored core module, as <code>docs/about.md</code> now does.</li> <li><strong>Changed</strong>: the license concept adds the lmodel/in-toto entry that <code>NOTICE</code> now carries.</li> <li><strong>Changed</strong>: the regeneration playbook says to leave the vendored <code>in_toto/in_toto_core.yaml</code> unchanged, since <code>tests/test_in_toto_import.py</code> pins its hash, and how to take a later lmodel/in-toto release.</li> <li><strong>Changed</strong>: the source map adds the vendored in-toto module, its pinning test and the lmodel/in-toto release, and asks a refresh to recount the example files.</li> </ul> https://w3id.org/lmodel/slsa/knowledge/log#2026-10-28 2026-10-28T18:27:56Z 2026-10-28T18:27:56Z <ul> <li><strong>Changed</strong>: the schema concept says that the adapt recipes run the released lokf 0.9.0 or later, that the copy renames <code>revision</code> to <code>slsa_revision</code> with its IRI kept, and that the schema declares no mappings, as <code>project.justfile</code> and the README now say.</li> <li><strong>Changed</strong>: the generated artifacts say that <code>.lokf/slsa.yaml</code> is also the release's schema asset, which the build checks, from the new comment in <code>main.yaml</code> and the domain-schema step of <code>knowledge-release.yaml</code>.</li> <li><strong>Changed</strong>: the test data concept says that <code>valid/</code> holds a file for every party role, now that <code>SlsaConsumer</code>, <code>SlsaInfrastructureProvider</code> and <code>SlsaBuildImageProducer</code> have examples, and names the other classes it covers.</li> <li><strong>Changed</strong>: the regeneration playbook drops the note that <code>lokf adapt</code> is unreleased and says that CI runs <code>just lokf-adapt-check</code> on Python 3.13, as <code>project.justfile</code> and <code>main.yaml</code> now say.</li> <li><strong>Changed</strong>: the documentation site names the home page's four buttons, which <code>HOME</code> in <code>website/site.config.mjs</code> sets since ff03483 added the Schema button.</li> <li><strong>Changed</strong>: the source map adds the README's Mappings section, the adapted-copy check in <code>main.yaml</code>, the domain-schema step of <code>knowledge-release.yaml</code> and the site's <code>HOME</code> setting, and drops the date of the first run.</li> </ul> https://w3id.org/lmodel/slsa/knowledge/log#2026-10-27 2026-10-27T01:42:32Z 2026-10-27T13:37:37Z <ul> <li><strong>Changed</strong>: the schema concept follows the README's corrected KTL section, which says that every other key keeps its SLSA name and that <code>lokf adapt</code> does not compare class attributes.</li> <li><strong>Resolved</strong>: the README's KTL section now names <code>media_type</code> and <code>predicate</code>, the two attributes that share a name with LOKF slots, and says that <code>lokf adapt</code> does not compare attributes.</li> <li><strong>Prose</strong>: reworded 4 concept bodies in plain English (in-toto-attestation, slsa-level, slsa-linkml-schema, test-data). No fact, link, number or frontmatter changed.</li> <li><strong>Changed</strong>: the schema concept counts 40 classes and one type, names the new in-toto and VSA classes and <code>slsa_result_value</code>, and says what each validator checks, as the modules and <code>docs/index.md</code> now do.</li> <li><strong>Question</strong>: the README says that no SLSA key shares a name with a LOKF key, but <code>media_type</code> and <code>predicate</code> do.</li> <li><strong>Added</strong>: the in-toto attestation framework, which the schema's <code>InToto</code> classes model, from <code>slsa_core.yaml</code> and the in-toto pages at the commit the SLSA v1.2 copy links to.</li> <li><strong>Changed</strong>: the test data concept names the SVN Source VSA, the new kinds of counter-example and <code>tests/test_schema_rules.py</code>.</li> <li><strong>Changed</strong>: the adoption study concept lists each challenge theme's sub-themes and issue count, which <code>slsa_adoption.yaml</code> now gives in the study's own names.</li> <li><strong>Changed</strong>: the level glossary says that a revision with no Source VSA has Source Level 0, as <code>source-requirements.md</code> says.</li> <li><strong>Changed</strong>: the license concept names the four sidecar workflows and the ktl-website templates, as <code>NOTICE</code> has since 61be9df.</li> <li><strong>Changed</strong>: the regeneration playbook says to run <code>just clean</code> after a class is renamed or removed, because <code>gen-java</code> deletes no file.</li> <li><strong>Changed</strong>: the source map adds <code>tests/test_schema_rules.py</code>, the Validating data section of <code>docs/index.md</code>, the schema's types and the in-toto attestation pages.</li> <li><strong>Changed</strong>: the documentation site follows <code>DOCS.exclude</code> and <code>REDIRECTS</code> in <code>website/site.config.mjs</code>, which replaced <code>MKDOCS</code> in 71dc33b; the schema files and the whitepaper under <code>docs/</code> are now linked on GitHub, not served by the site.</li> <li><strong>Changed</strong>: the source map's documentation-site row checks <code>DOCS</code> and <code>REDIRECTS</code> and adds <code>website/scripts/routes.mjs</code>, since <code>MKDOCS</code> is gone from <code>website/site.config.mjs</code>.</li> </ul> https://w3id.org/lmodel/slsa/knowledge/log#2026-10-23 2026-10-24T00:08:43Z 2026-10-24T00:35:20Z <ul> <li><strong>Changed</strong>: the documentation site's list of page sources reads as a list.</li> <li><strong>Changed</strong>: the documentation site is now the ktl-website Starlight site in <code>website/</code>, built by <code>knowledge-website.yaml</code>; the mkdocs workflows and <code>mkdocs.yml</code> are gone.</li> <li><strong>Changed</strong>: the schema's HTML distribution names its pages at <code>schema/</code> on the documentation site, where <code>website/site.config.mjs</code> puts the schema's gen-doc pages.</li> <li><strong>Changed</strong>: the site preview step names <code>npm run dev</code> in <code>website/</code>, since <code>just testdoc</code> needs mkdocs, which is no longer installed.</li> <li><strong>Changed</strong>: the source map names <code>website/</code> and <code>knowledge-website.yaml</code> for the documentation site, in place of <code>mkdocs.yml</code> and the two mkdocs workflows.</li> <li><strong>Changed</strong>: the adoption study concept quotes the title <code>docs/about.md</code> now cites, the arXiv record's current one (ab04158).</li> <li><strong>Resolved</strong>: <code>docs/about.md</code> cites arXiv:2409.05014 by its current title since ab04158.</li> <li><strong>Changed</strong>: the spec copy concept says that the upstream check lists no known differences, since 85c99e4 emptied <code>KNOWN_DIFFERENCES</code>.</li> <li><strong>Changed</strong>: the source map's upstream-watch row also re-reads <code>KNOWN_DIFFERENCES</code>.</li> <li><strong>Prose</strong>: reworded 10 concept bodies in plain English (generated-artefacts, license-and-attribution, openssf-supply-chain, secure-software-factory, slsa-adoption-study, slsa-level, slsa-linkml-schema, slsa-spec-copy, slsa-specification, test-data). No fact, link, number or frontmatter changed.</li> <li><strong>Rewrite</strong>: the schema concept follows the modular schema at version 1.2.0: the umbrella and its seven modules, the prefixed class and enum names, and the nine <code>lokf adapt</code> roots and thirteen known types the README and <code>project.justfile</code> now give.</li> <li><strong>Rewrite</strong>: the subsets explanation names the subsets as <code>slsa_core.yaml</code> now defines them, including the renamed <code>slsa_build_environment_track</code>, with their new descriptions.</li> <li><strong>Rewrite</strong>: the specification copy now matches <code>docs/spec/draft/</code> at SLSA tag v1.2 file for file, as <code>NOTICE</code> says, since the three extra files were dropped and <code>build-requirements.md</code> restored.</li> <li><strong>Resolved</strong>: the three files with no upstream match were removed and <code>build-requirements.md</code> restored in 57a4025; all 39 files now match SLSA tag v1.2 by git blob hash.</li> <li><strong>Rewrite</strong>: the specification page follows the new <code>docs/about.md</code>, which names the tracks and predicates the schema renders, and the schema header, which now names v1.2.</li> <li><strong>Resolved</strong>: the schema header gives <code>version: 1.2.0</code> and <code>source: https://slsa.dev/spec/v1.2</code> since 8695dc4, as <code>docs/about.md</code> does.</li> <li><strong>Rewrite</strong>: the level term cites the track pages the specification copy now holds, since <code>levels.md</code> is gone, adds the Build Environment levels, and names the renamed enums.</li> <li><strong>Rewrite</strong>: the track term cites <code>tracks.md</code> and <code>about.md</code>, since <code>levels.md</code> is gone from the specification copy, and names the renamed subsets and enums.</li> <li><strong>Rewrite</strong>: the generated artifacts add <code>docs/schema/slsa_merged.yaml</code> from <code>just gen-merged</code> and <code>.lokf/slsa.yaml</code> from <code>just lokf-adapt</code>, which <code>project.justfile</code> and <code>CONTRIBUTING.md</code> now name.</li> <li><strong>Rewrite</strong>: the test data follows the new example files, named after the prefixed classes, and the <code>ClassName-###.yaml</code> rule in <code>tests/data/README.md</code>.</li> <li><strong>Rewrite</strong>: the regenerate playbook adds <code>just gen-merged</code> and <code>just lokf-adapt</code>, which <code>CONTRIBUTING.md</code> now asks for after a schema edit, and says the schema is a folder of modules.</li> <li><strong>Rewrite</strong>: the attribution policy follows the README's shorter License section, which points to <code>NOTICE</code>; <code>NOTICE</code> now carries the specification's name, version and source, and says the copy is exact.</li> <li><strong>Rewrite</strong>: the OpenSSF page now carries the working group's name and project list from openssf.org, since <code>docs/about.md</code> no longer describes the group, and names the two slots that point at its projects.</li> <li><strong>Rewrite</strong>: the whitepaper page follows the new <code>docs/about.md</code>, which names five pipeline stages and the five snake_case slots the schema takes from the whitepaper.</li> <li><strong>Rewrite</strong>: the adoption study takes its authors, numbers and titles from the arXiv record, and the module, enums and slots from the new <code>docs/about.md</code> and <code>slsa_adoption.yaml</code>.</li> <li><strong>Question</strong>: the study's title in <code>docs/about.md</code> matches neither arXiv version.</li> <li><strong>Changed</strong>: the documentation site names the two schema files the new home page links.</li> <li><strong>Changed</strong>: the source map names the schema modules, <code>.linkmllint.yaml</code>, the <code>gen-merged</code> and <code>lokf-adapt</code> recipes, the specification pages that replace <code>levels.md</code>, and the openssf.org and arXiv records, and now counts <code>src/slsa/schema/README.md</code> as a source.</li> <li><strong>Prose</strong>: reworded 2 concept bodies in plain English (regenerate-and-test, slsa-linkml-schema). No fact, link, number or frontmatter changed.</li> <li><strong>Changed</strong>: the test playbook names the Python 3.10 to 3.14 matrix and the WSL2 <code>JUST_TEMPDIR</code> setting, from <code>main.yaml</code> and the <code>justfile</code> after the copier v0.5.0 update.</li> <li><strong>Changed</strong>: the schema concept says its <code>lokf adapt</code> copy is the bundle's domain schema, which ten SLSA classes it adds as concept types and which keys it renames, from the README's KTL section.</li> <li><strong>Changed</strong>: the source map adds the README's KTL section and <code>.copier-answers.yml</code> to its sources, and leaves out <code>src/README.md</code>, a short page from the project template.</li> </ul> https://w3id.org/lmodel/slsa/knowledge/log#2026-10-22 2026-10-22T14:08:55Z 2026-10-22T18:54:31Z <ul> <li><strong>Changed</strong>: the attribution policy's endorsement paragraph now says which claim the README makes and which <code>NOTICE</code> makes.</li> <li><strong>Prose</strong>: reworded 2 concept bodies in plain English (license-and-attribution, release). No fact, link, number or frontmatter changed.</li> <li><strong>Added</strong>: License and attribution, from the README's License and attribution section, <code>NOTICE</code> and <code>CONTRIBUTING.md</code>.</li> <li><strong>Rewrite</strong>: the release playbook now follows <code>semantic-release.yml</code> and the reworked <code>pypi-publish.yaml</code>, which publishes <code>slsa-linkml</code> only when <code>PYPI_RELEASE_ENABLED</code> is <code>true</code>.</li> <li><strong>Changed</strong>: the documentation site's preview runs only for pull requests from this repository's branches, as <code>test_pages_build.yaml</code> now says.</li> <li><strong>Changed</strong>: the test playbook says CI also runs <code>just lint</code> on Python 3.13, as <code>main.yaml</code> now does.</li> <li><strong>Changed</strong>: the specification copy names the weekly upstream watch, from <code>upstream-watch.yaml</code> and <code>scripts/check_upstream_release.py</code>.</li> <li><strong>Changed</strong>: the source map adds the release, attribution and upstream-watch sources, and names the governance and lint files it leaves out.</li> <li><strong>Changed</strong>: gen-project's settings moved from <code>config.yaml</code> to <code>.linkml/generators.yaml</code>, which <code>config.public.mk</code> now names, so the generated artifacts cite the new path.</li> <li><strong>Resolved</strong>: the merged schema in <code>docs/schema/slsa.yaml</code> was regenerated and now carries the schema's new description.</li> <li><strong>Changed</strong>: the source map names <code>.linkml/generators.yaml</code> where it named <code>config.yaml</code>.</li> </ul> https://w3id.org/lmodel/slsa/knowledge/log#2026-10-21 2026-10-22T14:08:54Z 2026-10-22T14:08:55Z <ul> <li><strong>Added</strong>: the SLSA project as an organization, from the SLSA repository README.</li> <li><strong>Added</strong>: CNCF TAG-Security as an organization, from its repository's license file.</li> <li><strong>Changed</strong>: the SLSA specification now names its publisher and its license, from the SLSA repository.</li> <li><strong>Changed</strong>: the whitepaper now names its publisher, its upstream copy and its CC BY 4.0 license.</li> <li><strong>Rewrite</strong>: the specification copy now records which upstream tree it matches, from a hash comparison with SLSA tag v1.2.</li> <li><strong>Resolved</strong>: 38 of the 42 files match <code>docs/spec/draft/</code> at SLSA tag v1.2 by git blob hash.</li> <li><strong>Question</strong>: three files of the specification copy have no match at SLSA tag v1.2.</li> <li><strong>Changed</strong>: the subsets explanation no longer states a purpose the schema does not give.</li> <li><strong>Changed</strong>: the source map now lists the SLSA and CNCF TAG-Security repositories.</li> <li><strong>Prose</strong>: reworded 4 concept bodies in plain English. No fact, link, number or frontmatter changed.</li> <li><strong>Added</strong>: the SLSA specification, from <code>docs/about.md</code> and the schema header.</li> <li><strong>Added</strong>: the CNCF Secure Software Factory whitepaper, from <code>docs/about.md</code>.</li> <li><strong>Added</strong>: the SLSA adoption study, from <code>docs/about.md</code>.</li> <li><strong>Added</strong>: the OpenSSF Software Supply Chain working group, from <code>docs/about.md</code>.</li> <li><strong>Added</strong>: the slsa LinkML schema, from <code>src/slsa/schema/slsa.yaml</code>.</li> <li><strong>Added</strong>: the SLSA specification copy in <code>src/slsa/schema/spec/</code>.</li> <li><strong>Added</strong>: an explanation of the schema's six subsets, from their descriptions in <code>src/slsa/schema/slsa.yaml</code>.</li> <li><strong>Added</strong>: the glossary term SLSA track, from the specification copy.</li> <li><strong>Added</strong>: the glossary term SLSA level, from the specification copy and the schema's level enums.</li> <li><strong>Added</strong>: the generated artifacts, from the <code>justfile</code> and <code>config.yaml</code>.</li> <li><strong>Added</strong>: the test data, from <code>tests/data/</code> and <code>tests/test_data.py</code>.</li> <li><strong>Added</strong>: the documentation site, from <code>mkdocs.yml</code> and the two Pages workflows.</li> <li><strong>Added</strong>: the regenerate-and-test playbook, from the <code>justfile</code> and the CI workflow.</li> <li><strong>Added</strong>: the release playbook, from <code>pypi-publish.yaml</code> and <code>pyproject.toml</code>.</li> <li><strong>Added</strong>: the knowledge sources map from the bootstrap discovery.</li> <li><strong>Question</strong>: the schema header and <code>docs/about.md</code> name different SLSA versions.</li> <li><strong>Question</strong>: the specification copy records no upstream commit.</li> <li><strong>Question</strong>: the committed merged schema is older than the source schema.</li> <li><strong>Removal</strong>: the sidecar's Example Service A, replaced by real concepts.</li> <li><strong>Removal</strong>: the sidecar's Example Service B, replaced by real concepts.</li> <li><strong>Initialization</strong>: Scaffolded the LOKF bundle for SLSA with placeholder services. Real concepts to follow.</li> </ul>