Source registry

Evidence stays attached

Sources remain traceable through assets, capabilities, and specifications.