H.11.1 Source Identity

Source identity answers which repository state was selected.

• A commit can identify one coherent internal source state without forcing products to release or deploy together.
• Record submodules, generated inputs, external repositories, patches, and configuration needed to reproduce the selected state.
• Add project tags or versions only when they communicate a real product or consumer contract.
• Treat supported branches and backports as maintained product lines with explicit policy.
• Keep source identity distinct from the artifact bytes, release record, promotion state, and running deployment.