# Topic map (docs to docs2)

This map shows the source areas reviewed to build docs2. It lists directories and anchor docs
rather than every single file.

Product and positioning
- Sources: docs/README.md, docs/overview.md, docs/key-features.md, docs/03_VISION.md,
  docs/04_FEATURE_MATRIX.md, docs/05_SYSTEM_REQUIREMENTS_SPEC.md, docs/05_ROADMAP.md
- Docs2: product/overview.md, product/roadmap-and-requirements.md

Market positioning and claims
- Sources: docs/market/*, docs/marketing/*, docs/claims-index.md
- Docs2: product/market-positioning.md, product/claims-and-benchmarks.md

Architecture and system model
- Sources: docs/07_HIGH_LEVEL_ARCHITECTURE.md, docs/high-level-architecture.md,
  docs/ARCHITECTURE_DETAILED.md, docs/40_ARCHITECTURE_OVERVIEW.md,
  docs/modules/platform/architecture-overview.md, docs/modules/*/architecture.md
- Docs2: architecture/overview.md, architecture/workflows.md, modules/index.md

Advisory alignment
- Sources: docs/architecture/advisory-alignment-report.md
- Docs2: architecture/advisory-alignment.md

Component map
- Sources: docs/technical/architecture/component-map.md
- Docs2: architecture/component-map.md

Ingestion and aggregation (AOC, linksets)
- Sources: docs/ingestion/aggregation-only-contract.md, docs/aoc/*,
  docs/advisories/aggregation.md, docs/vex/aggregation.md
- Docs2: ingestion/aggregation-and-linksets.md

AOC guardrails and library
- Sources: docs/aoc/aoc-guardrails.md, docs/aoc/guard-library.md
- Docs2: ingestion/aoc-guardrails.md

AOC linkset backfill
- Sources: docs/concelier/backfill/*
- Docs2: ingestion/backfill.md

Evidence and determinism
- Sources: docs/replay/*, docs/contracts/*, docs/ingestion/*, docs/data/*,
  docs/11_DATA_SCHEMAS.md, docs/ARCHITECTURE_DETAILED.md
- Docs2: architecture/evidence-and-trust.md, data-and-schemas.md

Reachability, VEX, unknowns
- Sources: docs/reachability/*, docs/vex/*, docs/signals/*, docs/modules/signals/*,
  docs/modules/vex-lens/architecture.md, docs/modules/vexlens/architecture.md
- Docs2: architecture/reachability-vex.md, signals/unknowns.md, signals/uncertainty.md

Reachability lattice and evidence
- Sources: docs/reachability/lattice.md, docs/reachability/evidence-schema.md,
  docs/reachability/edge-explainability-schema.md, docs/reachability/runtime-static-union-schema.md
- Docs2: architecture/reachability-lattice.md, architecture/reachability-evidence.md

VEX consensus
- Sources: docs/vex/consensus-overview.md, docs/vex/consensus-json.md
- Docs2: vex/consensus.md

Callgraph schema
- Sources: docs/signals/callgraph-formats.md
- Docs2: signals/callgraph-schema.md

Signal contract mapping
- Sources: docs/architecture/signal-contract-mapping.md
- Docs2: signals/contract-mapping.md

Unknowns ranking
- Sources: docs/signals/unknowns-ranking.md
- Docs2: signals/unknowns-ranking.md

Modules and services
- Sources: docs/modules/* (architecture, README, operations, runbooks)
- Docs2: modules/index.md

Advisory AI
- Sources: docs/advisory-ai/*
- Docs2: advisory-ai/overview.md

Orchestrator detail
- Sources: docs/orchestrator/*
- Docs2: orchestrator/overview.md, orchestrator/architecture.md, orchestrator/api.md,
  orchestrator/cli.md, orchestrator/console.md, orchestrator/runbook.md

Orchestrator run ledger
- Sources: docs/orchestrator/run-ledger.md
- Docs2: orchestrator/run-ledger.md

Operations and deployment
- Sources: docs/21_INSTALL_GUIDE.md, docs/deploy/*, docs/install/*,
  docs/operations/*, docs/runbooks/*, docs/quickstart.md
- Docs2: operations/quickstart.md, operations/install-deploy.md

Deployment versioning
- Sources: docs/deployment/VERSION_MATRIX.md
- Docs2: operations/deployment-versioning.md

Binary prerequisites
- Sources: docs/ops/binary-prereqs.md
- Docs2: operations/binary-prereqs.md

Runtime readiness
- Sources: docs/runtime/SCANNER_RUNTIME_READINESS.md
- Docs2: operations/runtime-readiness.md

Service SLOs
- Sources: docs/slo/*
- Docs2: operations/slo.md

Air-gap and offline kit
- Sources: docs/24_OFFLINE_KIT.md, docs/10_OFFLINE_KIT.md, docs/airgap/*
- Docs2: operations/airgap.md

Air-gap bundles and runbooks
- Sources: docs/airgap/overview.md, docs/airgap/offline-bundle-format.md, docs/airgap/runbooks/*
- Docs2: operations/airgap-bundles.md, operations/airgap-runbooks.md

Replay and determinism
- Sources: docs/replay/*, docs/runbooks/replay_ops.md, docs/release/promotion-attestations.md
- Docs2: operations/replay-and-determinism.md

Runbooks and incident response
- Sources: docs/runbooks/*, docs/operations/*
- Docs2: operations/runbooks.md, operations/key-rotation.md,
  operations/proof-verification.md, operations/score-proofs.md,
  operations/reachability.md, operations/trust-lattice.md,
  operations/unknowns-queue.md

Notifications
- Sources: docs/notifications/*, docs/modules/notify/*
- Docs2: operations/notifications.md

Notifications details
- Sources: docs/notifications/overview.md, docs/notifications/rules.md,
  docs/notifications/channels.md, docs/notifications/templates.md,
  docs/notifications/digests.md, docs/notifications/pack-approvals-integration.md
- Docs2: notifications/overview.md, notifications/rules.md, notifications/channels.md,
  notifications/templates.md, notifications/digests.md, notifications/pack-approvals.md,
  notifications/runbook.md

Router rate limiting
- Sources: docs/router/*
- Docs2: operations/router-rate-limiting.md

Release engineering and CI/DevOps
- Sources: docs/13_RELEASE_ENGINEERING_PLAYBOOK.md, docs/ci/*, docs/devops/*,
  docs/release/*, docs/releases/*
- Docs2: release/release-engineering.md, release/promotion-attestations.md,
  release/release-notes.md

API and contracts
- Sources: docs/09_API_CLI_REFERENCE.md, docs/api/*, docs/schemas/*,
  docs/contracts/*
- Docs2: api/overview.md, api/auth-and-tokens.md, data-and-schemas.md

Policy system
- Sources: docs/policy/*, docs/60_POLICY_TEMPLATES.md
- Docs2: policy/policy-system.md

Contracts and interfaces
- Sources: docs/contracts/*, docs/adr/*, docs/specs/*
- Docs2: contracts-and-interfaces.md

Scanner core contracts
- Sources: docs/scanner-core-contracts.md
- Docs2: contracts/scanner-core.md

Symbols specification
- Sources: docs/specs/SYMBOL_MANIFEST_v1.md, docs/specs/symbols/*
- Docs2: specs/symbols.md

SBOM handling
- Sources: docs/sbom/*
- Docs2: sbom/overview.md

Security, governance, compliance
- Sources: docs/13_SECURITY_POLICY.md, docs/17_SECURITY_HARDENING_GUIDE.md,
  docs/11_GOVERNANCE.md, docs/12_CODE_OF_CONDUCT.md, docs/28_LEGAL_COMPLIANCE.md
- Docs2: security-and-governance.md

Regulator threat and evidence model
- Sources: docs/28_LEGAL_COMPLIANCE.md
- Docs2: legal/regulator-threat-evidence.md

Identity, tenancy, and scopes
- Sources: docs/security/authority-scopes.md, docs/security/scopes-and-roles.md,
  docs/architecture/console-admin-rbac.md
- Docs2: security/identity-tenancy-and-scopes.md, security/multi-tenancy.md,
  security/row-level-security.md

Console admin RBAC
- Sources: docs/architecture/console-admin-rbac.md
- Docs2: security/admin-rbac.md

Crypto profiles and trust
- Sources: docs/security/crypto-profile-configuration.md,
  docs/security/trust-and-signing.md, docs/security/crypto-simulation-services.md
- Docs2: security/crypto-and-trust.md

Crypto compliance and licensing
- Sources: docs/security/crypto-compliance.md, docs/legal/crypto-compliance-review.md
- Docs2: security/crypto-compliance.md

Security hardening
- Sources: docs/security/dpop-mtls-rollout.md, docs/security/password-hashing.md,
  docs/security/secrets-handling.md, docs/security/rate-limits.md,
  docs/security/notifications-hardening.md, docs/security/export-hardening.md
- Docs2: security/operational-hardening.md

Audit events
- Sources: docs/security/audit-events.md
- Docs2: security/audit-events.md

Revocation bundles
- Sources: docs/security/revocation-bundle.md, docs/security/revocation-bundle-example.json
- Docs2: security/revocation-bundles.md

Quota and licensing
- Sources: docs/license-jwt-quota.md, docs/30_QUOTA_ENFORCEMENT_FLOW1.md,
  docs/33_333_QUOTA_OVERVIEW.md
- Docs2: security/quota-and-licensing.md

Risk model and scoring
- Sources: docs/risk/*, docs/contracts/risk-scoring.md
- Docs2: security/risk-model.md, risk/overview.md, risk/factors.md, risk/formulas.md,
  risk/profiles.md, risk/explainability.md, risk/api.md

Forensics and evidence locker
- Sources: docs/forensics/*, docs/evidence-locker/*, docs/ops/evidence-locker-handoff.md
- Docs2: security/forensics-and-evidence-locker.md, security/evidence-locker-publishing.md

Timeline forensics
- Sources: docs/forensics/timeline.md
- Docs2: security/timeline.md

Provenance and transparency
- Sources: docs/provenance/*, docs/security/trust-and-signing.md,
  docs/modules/attestor/*, docs/modules/signer/*
- Docs2: provenance/inline-provenance.md, provenance/attestation-workflow.md,
  provenance/rekor-policy.md, provenance/backfill.md

Database and persistence
- Sources: docs/db/*, docs/adr/0001-postgresql-for-control-plane.md
- Docs2: data/persistence.md, data/postgresql-operations.md, data/postgresql-patterns.md

Events and messaging
- Sources: docs/events/*, docs/samples/*
- Docs2: data/events.md

CLI and UI
- Sources: docs/15_UI_GUIDE.md, docs/cli/*, docs/ui/*, docs/console/*, docs/ux/*
- Docs2: cli-ui.md

CLI reference
- Sources: docs/cli/*
- Docs2: cli/overview.md

CLI command guides
- Sources: docs/cli/command-reference.md, docs/cli/crypto-commands.md,
  docs/cli/crypto-plugins.md, docs/cli/distribution-matrix.md,
  docs/cli/reachability-cli-reference.md, docs/cli/drift-cli.md,
  docs/cli/smart-diff-cli.md, docs/cli/triage-cli.md,
  docs/cli/unknowns-cli-reference.md, docs/cli/score-proofs-cli-reference.md,
  docs/cli/sbomer.md, docs/cli/audit-pack-commands.md,
  docs/cli/keyboard-shortcuts.md, docs/cli/troubleshooting.md
- Docs2: cli/commands.md, cli/crypto.md, cli/crypto-plugins.md,
  cli/distribution-matrix.md, cli/reachability.md, cli/triage.md,
  cli/unknowns.md, cli/score-proofs.md, cli/sbomer.md, cli/audit-pack.md,
  cli/keyboard-shortcuts.md, cli/troubleshooting.md

Console shell and navigation
- Sources: docs/ui/console-overview.md, docs/ui/navigation.md
- Docs2: ui/console.md, ui/navigation.md

Console workspaces
- Sources: docs/ui/console.md, docs/ui/findings.md, docs/ui/advisories-and-vex.md,
  docs/ui/downloads.md, docs/ui/runs.md, docs/ui/policies.md
- Docs2: ui/aoc-dashboard.md, ui/findings.md, ui/advisories-vex.md, ui/downloads.md,
  ui/runs.md, ui/policies.md

Console admin and governance
- Sources: docs/ui/admin.md, docs/console/admin-tenants.md, docs/ui/exception-center.md
- Docs2: ui/admin.md, ui/exception-center.md

Console SBOM and vulnerability exploration
- Sources: docs/ui/sbom-explorer.md, docs/ui/sbom-graph-explorer.md,
  docs/ui/vulnerability-explorer.md, docs/ui/reachability-overlays.md
- Docs2: ui/sbom-explorer.md, ui/sbom-graph-explorer.md,
  ui/vulnerability-explorer.md, ui/reachability-overlays.md

Console explainers
- Sources: docs/ui/explainers.md
- Docs2: ui/explainers.md

Console air-gap and attestations
- Sources: docs/console/airgap.md, docs/console/attestor-ui.md
- Docs2: ui/airgap.md, ui/attestor.md

Console forensics, observability, and risk
- Sources: docs/console/forensics.md, docs/console/observability.md, docs/console/risk-ui.md
- Docs2: ui/forensics.md, ui/observability.md, ui/risk-ui.md

Console branding and accessibility
- Sources: docs/ui/branding.md, docs/architecture/console-branding.md, docs/accessibility.md
- Docs2: ui/branding.md, ui/accessibility.md

Policy editor UI
- Sources: docs/ui/policy-editor.md, docs/security/policy-governance.md
- Docs2: ui/policy-editor.md

Triage UX
- Sources: docs/ux/TRIAGE_UX_GUIDE.md, docs/ux/TRIAGE_UI_REDUCER_SPEC.md
- Docs2: ui/triage.md

Console security
- Sources: docs/security/console-security.md
- Docs2: security/console-security.md

Approvals and exceptions
- Sources: docs/governance/approvals-and-routing.md, docs/governance/exceptions.md
- Docs2: governance/approvals.md, governance/exceptions.md

Developer and contribution
- Sources: docs/DEVELOPER_ONBOARDING.md, docs/onboarding/*,
  docs/10_PLUGIN_SDK_GUIDE.md, docs/18_CODING_STANDARDS.md, docs/contributing/*,
  docs/devportal/publishing.md, docs/process/implementor-guidelines.md
- Docs2: developer/onboarding.md, developer/plugin-sdk.md, developer/devportal.md,
  developer/implementation-guidelines.md

SDKs and clients
- Sources: docs/sdks/*
- Docs2: sdk/overview.md

Task packs and automation
- Sources: docs/task-packs/*
- Docs2: task-packs.md

Interoperability
- Sources: docs/interop/*
- Docs2: interop/sbom-interop.md, interop/cosign.md

Migration guidance
- Sources: docs/migration/*
- Docs2: migration/overview.md

Vuln Explorer overview
- Sources: docs/vuln/*
- Docs2: vuln-explorer/overview.md

Testing and quality
- Sources: docs/19_TEST_SUITE_OVERVIEW.md, docs/testing/*
- Docs2: testing-and-quality.md, testing/router-chaos.md

Observability and telemetry
- Sources: docs/metrics/*, docs/observability/*, docs/modules/telemetry/*,
  docs/technical/observability/*
- Docs2: observability.md, observability-standards.md, observability-logging.md,
  observability-tracing.md, observability-metrics-slos.md, observability-telemetry-controls.md,
  observability-aoc.md, observability-aggregation.md, observability-policy.md,
  observability-ui-telemetry.md, observability-vuln-telemetry.md

Benchmarks and performance
- Sources: docs/benchmarks/*, docs/12_PERFORMANCE_WORKBOOK.md
- Docs2: benchmarks.md

Guides and workflows
- Sources: docs/guides/*, docs/ci/sarif-integration.md, docs/architecture/epss-versioning-clarification.md
- Docs2: guides/compare-workflow.md, guides/epss-integration.md

Examples and fixtures
- Sources: docs/examples/*, docs/samples/*, docs/schemas/*
- Docs2: references/examples-and-fixtures.md

Training and adoption
- Sources: docs/training/*, docs/evaluate/*, docs/faq/*
- Docs2: training-and-adoption.md

Glossary
- Sources: docs/14_GLOSSARY_OF_TERMS.md
- Docs2: glossary.md