ReadonlychangeWhether a manifest diff was available and produced a Change Model this run.
ReadonlydependencyWhether a usage scan ran and produced a Dependency Model this run.
ReadonlyfindingWhether at least one rule/scan pass ran and produced a Finding Model this run.
ReadonlyownershipWhether an Ownership Model was built this run.
Which project-varying sub-models this particular run actually computed (OUT-04).
Without this, a persisted
data.evidence.jsonis ambiguous in exactly the way a governance artifact must never be: an absentdependencycould mean "nothing in this project depends on anything" (a real, reportable finding) or "this run never scanned for dependencies" (no finding at all, just an un-run pass). Those are opposite conclusions and the JSON looked identical either way.env-cap solves the same ambiguity by always computing all six sub-models, so absence never happens.
data-capdeliberately does not follow that: the usage scan is the expensive pass here, and--docsalone is supposed to stay cheap. So instead of forcing every run to pay for a full dependency scan, each sub-model's presence is stated explicitly.capability,lifecycle, andruntimeContracthave no flag -- they are always populated by construction, so a flag could only ever readtrue.A pass that ran and found nothing is
truewith an empty result, neverfalse: "we looked and found none" is a genuine finding, and collapsing it into "we didn't look" is precisely the confusion this field exists to prevent.