Per SSDF PS group: protect software. Requirements include (a) Protect all forms of code + (b) Provide a mechanism to verify integrity + (c) Archive + protect each release.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.