# Indexing policy and provenance

Reckon distinguishes source, generated, vendored, mirrored, ignored, and
duplicate-candidate content.

Policy precedence is:

1. explicit `reckon.yaml` analysis policy;
2. established `.gitattributes` generated/vendored signals;
3. source maps, generated headers, build metadata, SBOM, or SLSA evidence;
4. bounded inference, always labeled with confidence.

Git ignore and Reckon analysis policy are different. Reckon must never add a
tracked file to `.gitignore` or `.git/info/exclude` merely because
`index.exclude` omits it from analysis.

Provenance relationships are `generated_from`, `vendored_from`, `mirror_of`,
and `duplicate_candidate`. Exact content equality creates only a
`duplicate_candidate`; a hash cannot prove lineage. Hashing must stream large
files rather than loading whole trees into memory.

Declared generated, vendored, or mirrored repositories default to
provenance-only indexing. Full indexing requires an explicit override. Queries
against a derived artifact identify or redirect to canonical source when
source-evidenced provenance is available.

System configuration imports bounded `.gitattributes`
`linguist-generated`/`linguist-vendored` entries, generated-file headers,
source-map sources, CycloneDX PURLs, and SLSA/in-toto material URIs as
source-located policy or relationship evidence. These lower-authority signals
never override an explicit repository role or `index: full` choice. A generated
header without a named source is policy evidence only; Reckon does not invent a
`generated_from` target.

Every stored relationship retains evidence location, adapter/extractor,
evidence kind, confidence, target identity, freshness, and index generation.
Unknown or stale evidence remains explicit.