07 — Site architecture, licensing and boundaries
1. The house pattern — and one requirement this site cannot skip
Copy pki.sgit.ai: /llms.txt as the whole agent surface, /documents/ with raw markdown as source of truth, /admin/comms.html numbering asks (N1…) and tasks (T1…), /admin/versions.html, /about/participant.html, /shipped/. Add the /llms-full.txt that pki lacks.
The one thing this site cannot treat as optional is the agent-discovery ladder from 05__ §4, because a site about open source that agents cannot traverse fails in exactly the way the corpus already diagnosed:
"many agents can only fetch URLs that a search engine has already returned to them… A link listed inside a fetched document did not count as having been seen. It can read the map and cannot walk it."
"the package registry page, which is a summary written for a different purpose, becomes the authoritative source by default because it is the only one that ranks."
So: get indexed (the real fix), make /llms.txt self-sufficient rather than a link list (the cheap fix), and ship /llms-full.txt as a single-file concatenation (removes link-following entirely). And carry the estate's own practice — the markdown twin at every URL, extension swapped, with links inside the markdown pointing at markdown. 02__ §5 has the mechanism, including the Lambda@Edge detail that makes it work on static files.
2. ⚠️ Resolve the licensing inconsistency before writing a word
Covered fully in 02__ §1. Restated here because it blocks the build:
The estate runs three licences and the corpus never mentions the third. Apache-2.0 on code, CC BY 4.0 on ~1,100+ brief footers, and CC0 1.0 on docs.diniscruz.ai — which nobody has noticed and no document reconciles.
A site about open source licensing that carries an unexplained licence mismatch will be caught. Decide first: deliberate layered choice, or drift to be fixed. Then write the page — it is interesting either way.
And write the missing page: why Apache-2.0 rather than MIT. The patent grant? The NOTICE file? Defensive termination? The entire estate rests on that choice and the reasoning exists nowhere.
This site's own content is CC BY 4.0, consistent with the network. Stamp every raw markdown document and gate it in CI with licence-audit.py from the graphs.sgit.ai pack.
3. Quoting other people's material
Different from the sibling sites, because this one quotes the open-source world at length.
| Source | Regime | What the site may do |
|---|---|---|
research__history-and-success-stories.md (in this pack) | CC BY 4.0 | Ours. The sources it cites retain their own licences — check before reproducing anything beyond a short quotation |
| Wikipedia (used heavily in the research) | CC BY-SA 4.0 | Quote with attribution and a link back. Do not adapt — ShareAlike would bind the page. 04__-style paraphrase-with-citation is fine; wholesale restructuring is not |
| Project documentation — curl FAQ, sqlite.org, letsencrypt.org, ASF annual report | Per project; several are permissive, some are ARR | Quote briefly with attribution. Do not mirror. The ASF FY2025 report is a PDF — link it, do not rehost |
| Vendor and analyst reports — Black Duck OSSRA, CNCF survey, Stack Overflow, Octoverse, StatCounter, W3Techs | All rights reserved | Cite the number, the source, the date and the caveat. Never reproduce their charts. The research file's evidence table is already in the safe form |
| HBS WP 24-038 | Academic paper | Cite and link. Quote the method briefly. See 03__ §4 on the $8.8tn figure — never publish it without its definition |
docs.diniscruz.ai articles | CC0 1.0 | Republish freely. Attribute anyway, and keep rel="canonical" on the original URL with the recorded first-published date |
One rule above all of these: the research file marks several facts not verified this session and reports every fetch failure. Do not publish a marked-unverified fact as established. The site's credibility position is that it corrects other people's unsourced numbers; shipping one of its own would be self-defeating.
4. Do not publish
| Path | Reason |
|---|---|
library/alchemist/materials/ — the whole tree | Investment figures, valuation, revenue model, competitive positioning, pitch decks, named-competitor pricing. Note the founder profile lives here — the OWASP board claim in 06__ §1 is sourced from it, and that fact is public and quotable while the surrounding document is not |
team/humans/dinis_cruz/briefs/07/12/positioning-and-market/ — both files | Names Microsoft and dissects its governance programme as a partnering target; and a competitor map |
library/docs/_to_process/secure-send-llm-retention-compliance-gtm.md | API-credit resale margins, competitive analysis, naming-research admission |
team/roles/grc/reviews/03/01/v0.7.19__workstream-proposal__grc.md | Names a legal entity and enumerates its unfulfilled GDPR obligations; also maps a named third party's alleged violations |
team/roles/grc/reviews/02/19/ — both files | Name a private individual as risk acceptor, with signature blocks |
team/roles/appsec/reviews/02/21/v0.5.0__review__pki-architecture-security-revised.md | Already classified: "publishing an attack roadmap for live code" |
library/sgraph-send/dev_packs/v0.32.1__vault-to-vault-append-comms/03__provisioning-and-topologies.md | Names the driving rollout customer |
team/humans/dinis_cruz/briefs/08/06/payments-platform/* | Pricing, margins, provider endpoint detail |
Publish with care: the "somebody has to be the villagers" brief is excellent and belongs on the site, but its M&A statistic and seven market figures are loosely attributed ("reported", "is cited as finding") and the brief itself flags that "much of what circulates is vendor commentary recycling a smaller set of underlying studies." Re-source or soften.
5. Naming other people and projects
Fine, and necessary: naming projects, foundations, licences, and the public authors of public work — Torvalds, Stallman, Peterson, Raymond, Stenberg, Hipp, Roosendaal, Freund. Recording that curl shut down its bounty on 31 January 2026 and why, with Stenberg's own published words, is factual reporting the community needs.
Fine: naming companies in the relicensing history — MongoDB, Elastic, HashiCorp, Redis, IBM, Oracle. These are documented corporate acts with dates and public statements.
Not fine: running the Change-of-Control Stress Test on a named commercial competitor and publishing the verdict as a scorecard. Ship the test; let readers run it. The one exception is running it on yourself, which 04__ §2 recommends doing publicly.
Never: quoting forum, Discord or mailing-list participants without consent, or naming a private individual from the internal corpus.
6. Network boundaries
| Site | Owns | Boundary |
|---|---|---|
open-source.sgit.ai | The open-source position, the practice, the history, survivability, sovereignty, funding, OWASP | — |
wardley-maps.sgit.ai | Mapping technique, Explorer/Villager/Town Planner as a pattern | Shared: "somebody has to be the villagers". Wardley owns the PST pattern; open-source owns the NFR market argument. One canonical copy, cross-linked. Also shared: de-commoditisation, genesis-by-accident |
standards.sgit.ai | Instruments, provisions, crosswalks | Shared: SPDX as an evidence artefact, and the licence-compliance thesis (05__ §5a). Standards owns the machinery; open-source owns the argument |
graphs.sgit.ai | Graph theory, meaning through connectivity | Semantic OWASP and the PBOM sit on the boundary. Open-source owns the why, graphs owns the how |
risks.sgit.ai | Risk, acceptance, the grounding ladder | Little overlap. Supply-chain risk links both ways |
sgit.ai, pki.sgit.ai, nhi.sgit.ai, sg-sentinel.sgit.ai | Product and domain sites | Should link here for the licence and sovereignty argument |
riskmandate.ai | Commercial | References, is not referenced |
7. Page by page
/ — the thesis in 300 words: "the power of open source is not for the community… it is not to give back" and "open source is not free… what you get is freedom." Then the six history corrections as a teaser, because they establish that this site checks things.
/views/ — 01__'s five original pages. The site's identity.
/survivability/ — 04__ §§1–2. The stress test as a working tool, plus the self-audit.
/history/ — 03__. Corrections first, timeline behind them, six success stories not fourteen.
/practice/ — 02__. The three licences, why Apache-2.0, the read-key discipline, publish-the-source-next-to-the-render, and the compliance gap stated honestly or closed before launch.
/agents/ — 05__. Dual purpose: the argument about agents, and the machine surface for them.
/owasp/ — 06__. Blocked on the interview. Ship the summit history and mark the first-person account as pending rather than writing around it.
/funding/ — 04__ §§4–5. Three proposals, the cURL evidence, and a stated position.
/shipped/ — 00__ §7, unsoftened, including the self-audit and the missing SBOM.
/admin/, /network/ — house pattern. Publish the build order unresolved with 08__'s questions and tensions visible.
This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).