The sources

This book did not start as a book. It started as several years of the founder's own architecture briefs, written for other reasons, in repositories that are still moving. Twenty-one of them are carried here in full: the actual markdown, byte for byte, with its hash, next to what it says, why this site rests on it, and a graph of exactly where it lands. Sixty-three thousand words, and every one of them is upstream of a chapter.

The set, ranked

All of them as one graph

A document on its own tells you what it is about. Twenty-one drawn together tell you something no single one can: which ideas the corpus keeps returning to. The documents were written months apart, for different audiences, about apparently different subjects. What joins them here is not a taxonomy anyone imposed. It is the concepts they were independently measured to contain.

The set grew from fifteen to twenty-one on 23 August, and the growth immediately cost the section its neatest claim. At fifteen, a claim is worth its chain of custody was measured in every single document. At twenty-one it is measured in twenty, and the one that does not reach it is Compatibility Through Connectivity — one of the three oldest, written in February before the provenance vocabulary hardened. A universal that survives to n=15 and breaks at n=21 was never a universal. It is recorded here rather than quietly dropped, because the whole point of computing these numbers on every build is that they are allowed to move.

How the links are made, and which kind each one is

Three different things happen in this section, and mixing them up would be the easiest way to make it dishonest. So they are kept apart, and drawn apart.

1. The documents are carried, not summarised. Each .md under docs/sources/ is a byte-for-byte copy of a file in a public repository. docs/sources/manifest.json records the repository, the path, the commit, the licence, the byte count and the SHA-256. The build fails if a carried file no longer matches its recorded hash, because the copy is evidence and evidence is not edited.
2. The concept links are measured. Each of the concept map's twenty-four concepts has a declared list of phrases. The generator counts, mechanically, how often those phrases occur in each document. The phrase list is published — hover any concept on a document's page to see exactly what was counted. The counting is not a judgement. The list is, and that is why you can see it.
3. The site links are authored. Which chapter, ladder layer, vault or page actually rests on a document is a judgement, written down as one, with a note saying what the link is for. Nothing here pretends this kind is derived. In the graphs, a measured edge is dashed and carries its count; an authored edge is solid gold.

Influence then follows from the three by a formula stated on the table above and nowhere else: concepts + 2 × places + 3 × review asks resolved. The weights say something arguable — that a page resting on a document is stronger evidence of influence than a phrase appearing in it, and that a review going looking for a document is stronger still. Disagree by changing the formula; it is one line in admin/build/gen_docs.py and the ranking recomputes.

Provenance and licence

All twenty-one are carried from the-cyber-boardroom/SGraph-AI__App__Send, a public repository licensed Apache-2.0, at commit b561fa6b14. That licence is recorded on every page beside the file it applies to. Eighteen of the twenty-one also carry their own CC BY 4.0 line inside the file, stamped by the corpus's own licence audit; each page says which. Nothing here is relicensed and nothing is edited: what you read is what the repository holds at the commit named.

Two provenance notes worth recording, because both were checked rather than assumed. First, three of the twenty-one did not originate in that repository: Thinking in Graphs, Compatibility Through Connectivity and the Issues-FS Lexicon are Issues-FS documents, imported into library/concepts/ on 11 June 2026 and marked in that folder's readme as references rather than Send artefacts. All three are still published separately at owasp-sbot/Issues-FS__Docs, and all three copies are byte-identical across the two repositories. Each page prints its origin path and says so. An import that changed nothing is the cheapest possible proof that nothing was changed — and it is exactly those three, and only those three, that carry no CC BY line, because the corpus's licence audit stamped the Send tree and not the references imported into it. The pattern explains itself once you look.

Second, the source manifest prepared for this site flagged that same document as a licence blocker, because the copy the librarian saw carried no CC BY line. It still carries none. What resolves it is the repository: the file sits in two public Apache-2.0 repositories, which is a licence, just not the one the audit was looking for. That is a resolution of fact rather than a decision, and it is stated here rather than quietly closed.