The SCS must issue a source VSA stating the Source level of any revision at Level 1 or above, and anyone authorised to access a revision must be able to fetch its VSA; a revision with no VSA is Source Level 0. At Levels 1 and 2 the SCS may base the VSA on its understanding of its own system (design documents, security reviews), but from Level 2 up it must base it on the source provenance it issued.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.