landscape: add Attestation & Verifiable Evidence category

[imran-siddique]

The landscape half of this workstream has a gap I kept walking into, so here is a proposal rather than a comment.

The gap

The map currently covers two of the three things people build in this space:

Category	What it holds
Security Guardrails & Firewalls	prevention, before the thing happens
Observability & Tracing Telemetry	monitoring, while and after it happens
nothing	evidence a third party can verify without trusting the operator

Attestation and verifiable-evidence projects have nowhere to sit today, so they either get filed under Observability, where they do not belong (a trace you produced about yourself is not evidence to someone who does not trust you), or they are simply absent.

What this adds

Category 5, Attestation & Verifiable Evidence, with three subcategories and ten entries:

• Attestation Standards & Verification: IETF RATS, Veraison, Keylime
• Transparency & Provenance: IETF SCITT, in-toto, Sigstore, SLSA
• Agent Action & Runtime Evidence: Agent Action Capsule, TRACE, Agent Manifest

Comment banners for the categories after it are renumbered. No existing entry is touched.

Disclosure

Two of the ten entries are projects I work on, TRACE and Agent Manifest, and I have marked both external rather than member. I am aware that proposing a category your own work sits in looks like a landgrab, so two things:

1. Eight of the ten are other people's, and the three IETF and OpenSSF entries are the ones that make the category legible. The category stands up without mine and I would rather it merged with mine cut than not merged.
2. Agent Action Capsule is deliberately listed first in its subcategory. It is the closest peer to my own work in this space, it is doing the same job through a SCITT statement profile, and if this category only existed to hold my projects I would not have put it above them.

Cut, rename, or move anything. I am more interested in the category existing than in what is in it.

Checks run

landscape/landscape.yml parses under yaml.safe_load. 8 categories, 43 items total, schema fields match docs/data-schemas.md (name, logo, homepage_url, repo_url, description, project), and project uses only the documented member / external enum. Every repo_url and homepage_url was resolved before being added.

Per CONTRIBUTING this needs two or three Domain Editor approvals from different workgroups. Identity & Trust, Security & Privacy and Governance & Risk are the three with a stake in it.

[narko4u]

Reviewed from the Identity & Trust angle. The gap is real and the framing is right: a trace you produced about yourself is not evidence to someone who does not trust you. That is the same boundary drawn in the attestation definition (issue #43) and in the evidence-strength work in aaif/wg-identity-and-trust#5. The new category gives this space somewhere to sit instead of being filed under Observability by default.

I re-ran the checks locally: landscape.yml parses under yaml.safe_load, 7 categories and 33 items in the current file, and existing entries match the schema fields in docs/data-schemas.md. With this addition that becomes 8 categories and 43 items, matching the numbers in the proposal.

The Agent Action & Runtime Evidence subcategory is the one with the most growth ahead of it, and it will need the most maintenance, which is a good sign the category is worth having rather than a sign to keep it small.

Per CONTRIBUTING this needs two or three Domain Editor approvals from different workgroups. I am not a Domain Editor, so this is a participant review to give the editors cover, not a formal approval. Happy to help with anything the editors need while this moves.

[imran-siddique]

The Domain Editor roster landed in ONBOARDING.md on 3 September, after this PR was opened, which is why the body names three working groups and not the people. Naming them, since the process asks for it.

CONTRIBUTING wants two or three approvals from editors in different working groups. From the roster: @julianna-ciq for Identity & Trust, @kjamithash for Governance, Risk & Regulatory Alignment, Jautau White or Katherine Druckman for Security & Privacy. @91pavan or @mr-lee if Observability wants a say, since part of why this category exists is to stop attestation projects landing under Observability by default.

Re-checked against main at f7b893e today: still 7 categories and 33 items, so the 8 and 43 in the body hold and this still merges clean.

Cut, rename or move anything, mine first.

[julianna-ciq]

The Taxonomy group hasn't really discussed how we want to handle landscape definitions. I've asked in the Discord that we bring it up at our next meeting.

[imran-siddique]

@julianna-ciq thank you, and taking the Discord route as the right one.

One thing to make that meeting cheap rather than open-ended. The question is not really "how do we handle landscape definitions" in the abstract; it is a single choice with two options, and either works for me:

1. Categories are added as the landscape encounters them, in which case landscape: add Attestation & Verifiable Evidence category #44 merges on whether the category is real and the entries are accurate.
2. Categories require a group decision first, in which case landscape: add Attestation & Verifiable Evidence category #44 waits, and the group needs a standing route for proposing one so the next contributor is not in this position either.

If the group picks 2, I will withdraw #44 and refile it as a category proposal in whatever shape you want.

Could I get the date of that meeting? #44 has been mergeable for three weeks, and knowing it is parked until a specific date is worth more to me than a weekly guess.