M.01Title
How this site earns citation
Every claim here is meant to survive a check: a fixed evidence vocabulary, named sources with dates, explicit limits on what the tools may say, and a public correction trail.
M.02Key to marks
The five marks
One ink, separated entirely by geometry. Interior ink is monotonic with confidence (solid, hatched, empty), and obligation marks sit on the edge so they never contaminate that gradient. All five stay separable on a grayscale photocopy, which is where this document ends up.
| Mark | Means | What moves an item here |
|---|---|---|
| Evidence verified | Supported by evidence independent of the supplier | Documents, hashes, inspection, or an authoritative public record, held on file and not recalled from memory |
| Supplier-declared | Claimed but not independently checked | A written declaration, manifest or attestation from the party with an interest in the answer |
| Unknown | Nobody has the answer yet | The default state. Recording it honestly is this instrument’s core function |
| Material dependency | Carries something consequential downstream | Data egress, cloud accounts, remote management, or a priority-sector input |
| Review required | Needs a qualified human | A screening-list match under the declared exposure profile, or anything the tool cannot resolve from evidence |
Why there is no red, amber or green
Color only shows whether a list was checked and whether the name is on it. There is no severity scale, and no color says one company is riskier than another. A severity scale would be a verdict: the moment a traffic light appears, respondents optimize toward green. That means guessing, and guessing destroys the only data this instrument collects.
M.03Claim boundaries
Claim boundaries
Hard rules, not style preferences:
- No output ever says compliant, certified, secure, safe supplier, or approved. If an auditable certification process ever exists, this rule changes then and not before.
- Screening flags always name the list, the match basis (statutory name, parent, subsidiary, or name similarity) and the list version date.
- The six regimes are never aggregated into a single score. They answer different questions and are presented separately.
- US regimes are described as US regimes, not global bans. Trust context beyond the US is labeled as exactly that.
- Verbs state verifiable capability, such as documented, recorded or traceable, never guaranteed outcomes.
- The reach matrix is a coded matrix of statutory reach. It is not a Day-Out-of-Days, and it is not represented as one.
- Silence is never converted into a claim. A sheet nobody has triaged is reported as unreviewed, never as absent. Unticked exposure is reported as not assessed, never as none. Asserting that a category is absent, or that no exposure applies, requires someone to record it deliberately.
Where the ink rule applies to color
Stamp violet is reserved for marks applied to the document: the five evidence marks and the document’s own status stamp. Navigation, buttons, focus rings and selected answers use ribbon ink instead. Interaction is not a stamp.
M.04Sourcing
Sourcing rules
- Primary sources, meaning statutes, agency lists and official publications, anchor every regulatory statement, with access dates.
- Secondary sources such as law-firm alerts and news reports supply context and are labeled as such.
- Company disclosures, including a vendor’s account of its own security investigation, are reported as that company’s account and never as adjudicated fact.
- List snapshots carry their version date; the live agency list always controls. A stale embedded list is worse than a link.
- Where a figure rests only on secondary reporting, the page says so.
DoD 1260H rows show the Chinese name from DoD’s Mandarin-language list (name_zh) on a second line under the English name, in 12px $text-secondary (8pt in print). RoboSense is the one exception: we converted DoD’s Traditional form to Simplified, and the data file notes the change. Every name is tagged lang=“zh-Hans” and set in IBM Plex Sans SC, a self-hosted subset that fonts/make-subsets.py rebuilds from dod-1260h.json; the build fails if a character has no glyph. No pinyin anywhere.
M.06Disclosure
Independence and disclosure
Editorial control, the claim boundaries above and the correction process apply to every page. No supplier pays for placement, and there is no placement to buy.
M.07Corrections
Corrections
Factual errors are corrected in place and recorded in the changelog. Disputed characterizations get the dispute noted alongside the original claim until resolved. When a screening list changes, affected pages are updated and re-dated on the next review pass; the document cells at the top of every page carry its revision and issue date.
M.08Changelog
Changelog
| Issued | Rev | Change |
|---|---|---|
| 2026-10-12 | 25 | Status colors. LISTED is a yellow tag, “not listed” is Carbon’s secondary text color and “not checked” is its helper text color. They mark only whether a list was checked and whether the name is on it, not severity. |
| 2026-08-27 | 1.1 | Human-approved WebMCP proposals and review integrity. Agent write tools now display their exact payload and wait for a direct page approval before changing the form; all tool outputs are marked as untrusted. Material sheets stay in Review required while unreviewed or delegated, completeness requires every applicable evidence question to be answered, and missing independent evidence or requested documents produce explicit findings and next actions. Transfer imports are size-bounded, privacy language names browser-agent and export channels, public routes are canonicalized, and page-specific social metadata is complete. |
| 2026-08-27 | 1.0 | WebMCP production-review tools. Adds six browser-discoverable tools for reading the live review, inspecting a sheet, setting scope, triaging one category, recording explicit evidence, and issuing the printable review. Site tools call the same validated state transitions used by the DOM-backed controller: omitted evidence remains unanswered, exposure cannot become “none apply” without an explicit assertion, and evidence cannot be recorded until a sheet is deliberately marked in use. The release adds executable invariant tests and escapes delegated assignee text at review-render time. |
| 2026-08-17 | 0.9 | Document shell modernization. Adopts Matuzo’s 2026 HTML boilerplate selectively: explicit JavaScript capability state, mobile text-scaling opt-in, deferred module scripts, font preloading, canonical URLs, social-preview metadata, a theme color, and installable-site metadata. Each sheet keeps a unique title, description and canonical URL; print rules remain in the shared stylesheet because they are already purpose-built for the review artifact. |
| 2026-08-17 | 0.8 | Design verification closeout. Corrects the static revision metadata to the local issue day, moves the mobile “Begin with scope” action after the boundary notice so it cannot invite readers to skip the instrument’s limits, and loads the Latin fonts from Google Fonts so the pre-print register and ruled headline wrapping are deterministic across platforms. |
| 2026-08-17 | 0.7 | Correction: the issue date was wrong. The review derived its date from toISOString(), which is UTC, under a label reading “Issued locally”. East of Greenwich that printed the previous day for the first hours of every local day: a document whose purpose is to date evidence was mis-dating it. The stamp is now built from local date components and names the time zone, so a review handed across jurisdictions is unambiguous. Also: sheet summaries moved to a grid so the status keeps a stable right-hand column instead of wrapping under the name on narrow screens. |
| 2026-08-16 | 0.6 | Closing gaps found by adversarial review of 0.5. An old handoff block could still fabricate a claim: the Not applicable state changed meaning between revisions, so importing one asserted that a category was in use when the respondent had never said so. Old blocks now return those sheets to Unreviewed. The “Review required” empty state asserted absence against an exposure profile that had never been recorded; it is now conditional. Delegated sheets were counted as complete despite no evidence having been gathered; they now read as awaiting return and keep the partial-review warning. The no-JS fallback claimed full triage; it now under-claims. The header DRAFT cell was still stamp violet without being a stamp, and moved to ribbon ink. Touch targets moved from a width breakpoint to a pointer query, the tab strip gained a scroll cue and scrolls the current tab into view, and the reach matrix gave back viewport width on phones. |
| 2026-08-16 | 0.5 | Silence is not a claim. Every sheet now starts Unreviewed and is reported as unreviewed rather than disappearing from the issued review; a triage counter reports how many of the twelve were assessed, and the footer marks a partial review as partial. Unticked exposure now reads not assessed, with a separate box for recording that none applies. The previous build converted both silences into negative claims, contradicting the evidence discipline the rest of the instrument rests on. Closed sheets now show their recorded status and assignee. Stamp violet was being used for navigation, buttons and focus as well as evidence; it is now reserved for marks applied to the document, with interaction moved to ribbon ink. Mobile header compressed from about a quarter of the viewport to under a fifth, tabs reduced to one scrollable row, all controls given a 44px minimum target. |
| 2026-08-16 | 0.4 | Redesign: Counterfoil. The site is rebuilt as a form sheet: a pre-print layer carrying the law, and a fill layer carrying your evidence. Adds the reach matrix (12 categories × 6 regimes, coded not colored, with the two company-level regimes segregated behind a doubled rule). Replaces the color-coded status chips with five single-ink marks separated by geometry, which survive grayscale print. |
| 2026-08-15 | 0.3 | Added the FCC’s July 28, 2026 extension of the Covered List to foreign-produced advanced robotic devices and connected power inverters, with the scope limit noted: it blocks authorization of new covered models rather than prohibiting devices already in use. Terminology aligned to the Supply Chain Resilience policy naming. |
| 2026-08-15 | 0.2 | Corrections. (1) UFLPA priority sectors: the statute names cotton, tomatoes, and polysilicon. Aluminum, PVC, and seafood were added in the July 2023 strategy update. Caustic soda, copper, jujubes, lithium, and steel came in later updates (latest 2025-08-19). (2) The UFLPA entity total of 144 was stale. The count is 187 entities by our count of the DHS UFLPA Entity List (last updated July 31, 2026), including 45 effective August 3, 2026. (3) The wardrobe example named a company from press reporting; that paragraph was removed because it is not a primary source. (4) The 1260H drone note understated DJI, listed since January 2024. (5) The 1260H release date was corrected to June 8, 2026. The June 2026 update lists 188 entities (80 parent companies) and removes 10. |
| 2026-08-15 | 0.1 | Initial draft build. Not published; pending policy groundwork, legal review of claims vocabulary, and a list-refresh process. |