Updating the reference snapshot

Keep the reviewable source → catalog → wiki chain. Runtime retrieval is offline; updates are explicit maintenance work.

Create a branch. Download an XLSX export from the official public compendium into a temporary/private workspace. Do not import a filled-in assessment workbook.
Create a Python virtual environment and install requirements-import.txt with the pinned version. Run python scripts/import_compendium.py /path/to/export.xlsx --date YYYY-MM-DD using the actual retrieval date.
The importer stops if table shape or expected counts change. Inspect new rows/columns before changing its assertions. It imports only public reference tabs and never evaluates formulas or macros.
Run npm run build:wiki. Review sources/compendium.json, sources/manifest.json, data/catalog.json and generated pages. Compare identities, forward edges, reverse disagreements, applicability (including blanks), mappings and documentation URLs. Never silently remove a stale generated page; review its replacement/removal.
Adjust original verification guidance if a control changes. Add a focused behavioral regression test for a material semantic change. Update source limitations and append to wiki/log.md.
Run npm run check, the skill package checker where available, and npm audit --omit=dev. Review public/private separation and licensing. Open a PR with the source date and meaningful deltas.

The XLSX binary hash captures a particular export; Google may produce different binary metadata for identical cell content. The normalized JSON hash is the reproducibility check for catalog generation. Hashes detect accidental divergence; they are not digital signatures or a substitute for trusting/reviewing the commit.

The source’s framework mappings may lag the linked standards. Update an original mapping only through a new source snapshot; keep project corrections separately attributed. An upstream count or marketing statement never overrides the observed rows.

Complementary research references

Maintain these separately from the DASF extraction. Review the exact upstream revision and relevant files, then update sources/research.json, the cited research page and any affected adaptation together. Record what was inspected, licensing, retrieval date and what remains unverified. Do not import execution instructions as authority or treat a reference as a tested integration.

Register only reviewed public documents in src/references.mjs; this allowlist drives MCP retrieval and search, and selects the research entries in website search. Add links in the generated index template (scripts/build.mjs), source register and llms.txt when the reading route changes. Rebuild the wiki and run npm run check; verify source-filtered searches still return only the requested DASF kind. No source fetch occurs at server startup.