spb/tools-spboucher-ai

1# Source and evidence policy23## Trust ladder41. **Official site / official documentation / repository** of the product (primary). Required for every record (`official_site`).52. **Official license page, pricing page, policy page, release notes, package registry** — required to assert `license_spdx`, `pricing_model` (commercial), `privacy_posture`, `product_status` changes.63. **Primary announcements** (vendor blog, press release) — accepted for renames and acquisitions, cited as `news`.74. **Academic papers** for method claims.85. **Third-party directories, forums, reviews** — discovery only; never cited as evidence for a published claim.910## What a record may claim11| Claim | Evidence required |12|---|---|13| Name, type, summary, capabilities | official site/docs |14| License | license file or page (`license_page`/`repository`), SPDX identifier |15| Pricing **model** | pricing page (`pricing_page`) with `pricing_checked_at`; prices themselves are never recorded |16| Privacy posture, data residency, certifications | vendor policy/security page (`policy_page`); otherwise omitted |17| Status (deprecated, discontinued, renamed) | explicit vendor statement or archived repository; a down site alone → `unknown` + note |18| Comparisons | documented differences only; no unmeasured performance claims |1920Everything else is `uncertainty_note` + `confidence: medium|low`. Low-confidence records are not published.2122## Crawling and copyright23- Fetches use a declared User-Agent (`OUTBOUND_USER_AGENT`), GET with 20 s timeout, 1 MiB cap, ≤ 5 redirects, 250 ms pacing, daily/weekly schedules — a handful of requests per site per week.24- `robots.txt`: the checker only fetches URLs that editors recorded as official pages (homepage, docs, pricing, license, policy). It does not crawl, follow links or index content; it stores a title, a canonical URL and a content hash, never the page body.25- Sites that block automated clients (401/403/405/429) are marked *unverifiable*, not broken, and are re-checked manually.26- Descriptions are original editorial prose; vendor text is never copied. Logos are not redistributed (monograms are generated). Product names are used nominatively.27- Official APIs/feeds are preferred when they exist (e.g. GitHub API for license metadata) — see `docs/ingestion.md`.2829## Security of ingestion30Fetched content is untrusted: SSRF guard (private/loopback/link-local/CGNAT/metadata ranges, `.local`/`.internal`/cluster hostnames, redirect re-validation, https→http downgrade rejected); HTML is never rendered; AI suggestions wrap page text as inert data, demand JSON, and keep only evidence quotes that exist verbatim in the page.31