The schema itself follows semver, governed by graph/schema/versioning.md. Every version is a CatalogVersion node in the graph (the meta-graph references itself).

Every PR against main runs:

Most edges in the graph are internal: AgentVersion → boundto → ModelVersion is fully under our control — both endpoints are nodes we author. But every Claim → evidencedby → EvidenceSource ultimately points outward: at a vendor doc page, a published package, a captured observation, an external attestation. That outward arrow is the evidence boundary.