← Catalogue
World Models · legacy example

Software Product & System

This meta-model describes software in full context: products offered by producers, their releases and components, declared dependencies, and the deployed systems and environments where releases actually run. It is its own model because software has a double life, as a published artifact with versions and licenses and as an operated system with environments and advisories, and the two must be described together to answer questions about provenance, exposure and lifecycle.

AI YAMLAGENTS.mdSource
IDworld.n4-software-product-and-system
Version history0.2.0-legacy
CategoryReference example
IndustryCross-industry
Domainknowledge-information
Tagssoftware, product, system
Data structure

Bundles and layers

Bundle

product

The offered software artifact

Layers

identity`: products, producers, categories · `release`: versions, channels, publication

Bundle

architecture

What the software is made of

Layers

systemComposition`: components and their assembly · `dependencyAndSbom`: declared dependencies and bill of materials

Bundle

operation

Where and how it runs

Layers

deploymentAndEnvironment`: deployed systems, environments, instances · `lifecycleAndSupport`: support status, advisories, end of life

Findings

Catalogue-native findings must describe the information grouped by each layer. This legacy version does not declare them separately.

Questions & artifacts

Questions, artifact requirements and serial naming rules are required by Vercy vNext; they remain unassigned in this reference version.

Service layers

How this specification operates

Dimension & namespace

  • imports: aismm (ALIGN): whole-model binding; every bundle of this model aligns to the corresponding AISMM area so a full AISMM product model can stand behind any record here.
  • REFERENCE `world.organization` (O1): producing organizations and system operators.
  • REFERENCE `world.intellectualProperty` (N12): licenses and other rights over software subject matter.
  • REFERENCE `world.dataset` (N3): datasets produced or consumed by deployed systems.
  • REFERENCE `world.identifierNaming` (N8): package and product identifier schemes.
  • imports: spdx (ALIGN): bill of materials structure and license expressions.

Canon, patches & standards

  • imports: aismm (ALIGN): whole-model binding; every bundle of this model aligns to the corresponding AISMM area so a full AISMM product model can stand behind any record here.
  • REFERENCE `world.organization` (O1): producing organizations and system operators.
  • REFERENCE `world.intellectualProperty` (N12): licenses and other rights over software subject matter.
  • REFERENCE `world.dataset` (N3): datasets produced or consumed by deployed systems.
  • REFERENCE `world.identifierNaming` (N8): package and product identifier schemes.
  • imports: spdx (ALIGN): bill of materials structure and license expressions.

Artifact formats & serial data

Format-independent core. Concrete artifact formats and naming prefixes are not declared in this legacy version.

Policies & accepted processes

  • `softwareLicenseContract`: the usage license attached to releases.
  • `supportAndMaintenanceContract`: producer or operator obligations for a product or system.
  • `sbomDisclosureContract`: terms of sharing the dependency bill of materials with consumers.

Read / add / edit / delete

CRUD procedures and interface bindings are not declared in this legacy version.

Ownership, roles & access

The neutral owner archetype is the producing organization for products and releases, and the operator for deployed systems; each owns its slice of the record. Access is always granted by the respective owner through the catalogue's S1/S2 ownership and access models, with disclosure of SBOMs and inventories audited via S4.

Existing assembly

Objects, relationships, events and projections

Objects

  • `softwareProduct`: a software offering with identity and producer; key attributes: productId, name, category, producerRef, lifecycleStatus.
  • `release`: a published version of a product; key attributes: version, releasedAt, channel, checksum.
  • `component`: a constituent part of a release; key attributes: componentId, componentType, packageRef.
  • `dependency`: a declared need on another component or release; key attributes: constraintRange, scope, resolvedReleaseRef.
  • `deployedSystem`: a running installation serving a purpose; key attributes: systemId, purpose, operatorRef, criticality.
  • `environment`: a hosting context for systems; key attributes: environmentType, locationRef, platform.
  • `advisory`: a published notice about defects or exposure; key attributes: advisoryId, severity, affectedRange, publishedAt.

Relationships

  • `softwareProduct` -> publishes -> `release` (1:N): the product's version history.
  • `release` -> composedOf -> `component` (1:N): the release's bill of materials.
  • `release` -> declares -> `dependency` (1:N): stated needs on other software.
  • `dependency` -> resolvesTo -> `release` (N:1): the concrete release satisfying a declared need.
  • `deployedSystem` -> runs -> `release` (N:N): which versions are live where.
  • `deployedSystem` -> hostedIn -> `environment` (N:1): the system's hosting context.
  • `advisory` -> affects -> `release` (N:N): exposure mapping from notice to versions.

Events

  • `releasePublished`: a new version became available on a channel.
  • `releaseWithdrawn`: a published version was pulled from distribution.
  • `systemDeployed`: a release went live in an environment.
  • `systemDecommissioned`: a deployed system was retired.
  • `advisoryIssued`: a defect or exposure notice was published.
  • `endOfLifeAnnounced`: the producer declared the end of support for a product or release line.

Projections

  • `productCataloguePage`: public product and release information; omits deployment and operator detail.
  • `sbomExport`: the component and dependency graph of a release; omits product marketing and operations.
  • `operationsInventory`: systems, environments and running versions for the operator; omits producer-side release internals.