Sources

Sources provide the facts; CopilotForge provides the reasoning structure, programme method, review gates and reusable artefacts for applying them (design brief section 14).

Policy

• Sources are structured records in sources/*.toml, validated against schemas/source.schema.json. Each has an id, name, URL, authority (publisher, type, what it is authoritative for), scope (products, departments, jurisdiction), freshness (volatility, review interval, last reviewed) and usage class.
• Skills cite source ids in metadata.sources. scripts/build-sources.py writes each skill's references/sources.md.
• Volatile claims (availability, licensing, limits, preview status, model catalogues, connectors, product names) are never asserted in skill prose; the skill points to the source record and tells the reader to check it.
• Preferred authorities, in order: Microsoft Learn and official product documentation; Microsoft Adoption and the Microsoft Trust Center; Microsoft Research and official engineering documentation; GitHub documentation; NIST; UK Government and Information Commissioner's Office guidance; ISO references where licensing permits; W3C and other primary standards bodies.
• Secondary sources (blogs, community posts) only where no suitable primary source exists, with secondary_reason.
• Usage classes: cite-only (read, cite and summarise in your own words; never reproduce), quote-with-attribution (short quotations allowed), open-licence (reuse under the stated licence with attribution). When unsure, use the more restrictive class. Microsoft Learn is treated as cite-only.

Freshness

last_reviewed is updated only after a person or agent has actually read the source. scripts/check-sources.py warns when a review is overdue. Link checking runs in the separate links workflow because it needs network access.

Catalogue