Ledger Vocabulary
Subject classes, designator kinds, observation methods, predicates, and the verification ladder
The vocabulary is closed: a value outside these lists is rejected. Terms marked Y2 profile extend the base framework for issuer and supply-chain research and follow the same evidence, verification, and interval rules.
Subject classes
| Class | Examples |
|---|---|
person | A researcher, an executive, a maintainer |
organization | A company, a vendor, an agency, a threat group identified by its ATT&CK ID |
system | A site, a host, a repository, a service, a model, an autonomous system |
Designator kinds
| Kind | Value | Namespace |
|---|---|---|
published-name | The name as the page prints it | — |
pseudonym | A name sources present as an alias | — |
handle | The login, without @ | Platform or host, such as github.com |
email | Lowercase addr-spec | — |
url | Exact http(s) URL without userinfo | — |
domain, hostname | Lowercase host, no trailing dot | — |
asn | AS and a decimal number | — |
public-key | Lowercase hex fingerprint | Algorithm, such as ssh-ed25519 |
external-id | A registry identifier | wikidata (Q…), lei (20 characters with valid check digits), attack-group (G and four digits), sec-cik (ten digits, Y2 profile) |
ticker (Y2 profile) | Uppercase listed symbol | ISO 10383 exchange MIC, such as XNAS |
Observation methods
public-web-page, public-profile, public-dns, certificate-transparency, public-archive,
public-registry, public-code-host, and analyst-note.
Interaction with the subject, authentication, and non-public access have no method name, so they cannot be recorded as if they were valid sources.
Predicates
| Predicate | From | To | Meaning |
|---|---|---|---|
designated-by | subject | designator | The subject is referred to by this identifier |
preferred-label | subject | name designator | Display this name; needs a live designated-by |
same-as | subject | subject of the same class | Hypothesis that the rows are one entity |
distinct-from | subject | subject of the same class | Hypothesis that they are not |
member-of | person | organization | A public role, in qualifier |
affiliated-with | subject | subject | A weaker public tie |
controls | person or organization | system or designator | Claimed control; stays weak unless a source speaks to control |
operates | person or organization | system | A source says this party runs that system |
resolves-to | designator | designator | A public resolution for the interval observed |
follows | handle | handle | A public page shows one account following another |
supplies (Y2 profile) | organization | organization | The first supplies goods or services to the second |
subsidiary-of (Y2 profile) | organization | organization | The first is owned or controlled by the second |
same-as and distinct-from never merge rows. When both are live for a pair, the pair is contested.
Verification ladder
Verification belongs to a claim, not to a subject.
| State | Honest use | Evidence the ledger requires |
|---|---|---|
unverified | Written down, not checked | At least one observation |
mentioned | The string appeared; no page ties it | A public retrieval |
located | One retrieved page ties them | A public retrieval |
self-asserted | The subject's own page states it | A public retrieval |
cross-linked | Two independent pages identify the link | Retrievals of two different pages |
corroborated | A further independent source agrees | Retrievals of two different pages |
contradicted | A source disputes the link | A public retrieval |
stale | The page is gone or no longer shows it | A public retrieval |
analytic | The only support is an analyst note | Only analyst notes |
A claim supported only by notes is analytic or unverified.
Source grades
| Grade | Meaning |
|---|---|
primary | The page is the thing itself: the profile, the staff page, the registry entry |
secondary | The page reports on the thing |
analytic | An analyst note connecting other observations; it must cite them |