Four independent concerns
| Concern | Question | Examples of evidence |
|---|---|---|
| Ownership | Which Catalog or Brand authority governs the artifact? | Manifest boundary, stable Catalog identity, and declared mounts. |
| Visibility | Who is allowed to discover or read that authority or its carrier? | Repository, registry, and package access policy. |
| Distribution | By which versioned channel does the artifact reach another workspace or application? | npm registry, Git dependency, generated bundle, or immutable native image digest. |
| Publication | Has a validated version been deliberately made available through that channel? | Successful release job, tag or package version, provenance, and registry readback. |
Sources for block 1: product-catalog-term, github-packages
Independence matters
A private Catalog can be distributed to authorized products without becoming public. A shared Catalog can remain unpublished while contributors validate it locally. Publishing a package does not change which Catalog owns its contracts, and repository visibility does not prove that a supported consumer channel exists.
Component contracts, Composition documents, generated target code, runtime carriers, and Brands can use different channels while remaining one compatible release set.
Sources for block 1: product-catalog-term, product-composition-term
Compatibility and provenance
- Package and Git versions identify the consumer-facing API and source revision.
- Native runtime images use immutable digests and verified library checksums.
- Generated facts record producer commits and package versions so documentation can distinguish authority from a stale projection.
- Release gates acquire artifacts from outside the producer checkout and read their versions and compatibility facts back.
Sources for block 1: catalog-bundle, design-system-bundle
Sources for block 2: catalog-bundle
Consumer and contributor paths
Consumers begin with Installation and target selection, then acquire released versions through the documented channel. Contributors begin with the authoring workflow, validate authority and projections, and publish only through the canonical release path.
Sources for block 1: github-packages, catalog-publication-workflow