briansrls · Jun 21, 2026 · Jun 20, 2026 · Jun 21, 2026 · Jun 21, 2026 · Jun 21, 2026
diff --git a/dsl/extdeps/access/aws_iam.dag b/dsl/extdeps/access/aws_iam.dag
@@ -13,6 +13,17 @@
 module extdeps.access.aws_iam
 
 import std.types { NonEmptyStr }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// External-authority anchor (promotes the Source citation above to the structured carrier
+// that v2.lens.extdeps_external_authority gates on — DESIGN §3).
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html"
+  }
+}
 
 type Effect
   = Allow

diff --git a/dsl/extdeps/access/posix.dag b/dsl/extdeps/access/posix.dag
@@ -13,6 +13,18 @@
 
 module extdeps.access.posix
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// External-authority anchor (promotes the Source citation above to the structured carrier
+// that v2.lens.extdeps_external_authority gates on — DESIGN §3).
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "pubs.opengroup.org/onlinepubs/9699919799/basedefs/sys_stat.h.html"
+  }
+}
+
 // The three permission bits applied per class (e.g. S_IRUSR / S_IWUSR / S_IXUSR for the owner).
 type PermissionBits {
   read: Bool       // r

diff --git a/dsl/extdeps/access/rbac.dag b/dsl/extdeps/access/rbac.dag
@@ -14,6 +14,17 @@
 module extdeps.access.rbac
 
 import std.types { NonEmptyStr }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// External-authority anchor (promotes the Source citation above to the structured carrier
+// that v2.lens.extdeps_external_authority gates on — DESIGN §3).
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "csrc.nist.gov/projects/role-based-access-control"
+  }
+}
 
 // PRMS ⊆ OPS × OBS — a permission is an operation on an object.
 type Permission {

diff --git a/dsl/extdeps/access/zanzibar.dag b/dsl/extdeps/access/zanzibar.dag
@@ -15,6 +15,17 @@
 module extdeps.access.zanzibar
 
 import std.types { NonEmptyStr }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+// External-authority anchor (promotes the Source citation above to the structured carrier
+// that v2.lens.extdeps_external_authority gates on — DESIGN §3).
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.usenix.org/conference/atc19/presentation/pang"
+  }
+}
 
 // ⟨object⟩ ::= ⟨namespace⟩ ':' ⟨object id⟩          (e.g. "doc:readme")
 type Object {

diff --git a/dsl/extdeps/bmc/http.dag b/dsl/extdeps/bmc/http.dag
@@ -18,6 +18,16 @@ module extdeps.bmc.http
 
 import std.types { NonEmptyStr }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.dmtf.org/standards/redfish"
+  }
+}
+
 service redfish.Http {
   // Authenticated read of the system resource (power state, manufacturer, etc.) — the
   // minimal "first contact" that proves the BMC is reachable AND the credentials work.

diff --git a/dsl/extdeps/bmc/openbmc.dag b/dsl/extdeps/bmc/openbmc.dag
@@ -19,6 +19,16 @@ import std.bmc { BmcFirmwareFamily, OpenBmc, BmcProtocol, Redfish, Ipmi }
 import std.credentials { FactoryLogin }
 import std.types { List }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "github.com/openbmc/openbmc"
+  }
+}
+
 // The published OpenBMC factory login (see anchor above). Public, world-known value —
 // cited as a source literal precisely because it is NOT a secret; it is rotated on first
 // contact (rotation is a workflow policy, not modeled here).

diff --git a/dsl/extdeps/cloud/hetzner.dag b/dsl/extdeps/cloud/hetzner.dag
@@ -22,6 +22,16 @@ import std.measure {
 }
 import std.types { NonEmptyStr }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "docs.hetzner.com/cloud/servers/overview"
+  }
+}
+
 type HetznerCloudServerType = Cax11 | Cax21 | Cax31 | Cax41
 
 type HetznerCloudServerCatalogRow {

diff --git a/dsl/extdeps/communication/medium.dag b/dsl/extdeps/communication/medium.dag
@@ -50,6 +50,16 @@
 
 module extdeps.communication.medium
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "en.wikipedia.org/wiki/Means_of_communication"
+  }
+}
+
 // Whether decoding from a medium back to semantic values loses information.
 //
 // DECOMPOSITION CHECKPOINT (DESIGN.md §2): 🟢 PRIMITIVE

diff --git a/dsl/extdeps/cpu/types.dag b/dsl/extdeps/cpu/types.dag
@@ -14,6 +14,16 @@ import extdeps.hardware { Hardware }
 
 import extdeps.toolchain.types { Architecture }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "en.wikipedia.org/wiki/CPU_socket"
+  }
+}
+
 // CpuSocket — the physical CPU mount, decomposed from the marketing string (e.g.
 // "LGA4926" = a Land Grid Array package with 4926 contacts/lands). `package` is the
 // contact technology (a closed set); `contact_count` is the number of electrical

diff --git a/dsl/extdeps/diagnostic/edac.dag b/dsl/extdeps/diagnostic/edac.dag
@@ -3,6 +3,16 @@
 
 module extdeps.diagnostic.edac
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.kernel.org/doc/html/latest/admin-guide/ras.html"
+  }
+}
+
 // 🟡 dissolved — feature:diagnostic-edac-mock-response — scaffold:hand-authored mock_response —
 // dissolve-on-arrival: Phase-2-hermetic RecordedFixture replay from claim_batch --fixture-store
 // (recorded wet via --record); the published corpus (extdeps.diagnostic.mock_corpus) now governs

diff --git a/dsl/extdeps/diagnostic/ipmi.dag b/dsl/extdeps/diagnostic/ipmi.dag
@@ -7,6 +7,16 @@ module extdeps.diagnostic.ipmi
 
 import std.types { NonEmptyStr }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.intel.com/content/www/us/en/products/docs/servers/ipmi/ipmi-second-gen-interface-spec-v2-rev1-1.html"
+  }
+}
+
 // 🟡 dissolved — feature:diagnostic-ipmi-mock-response — scaffold:hand-authored mock_response —
 // dissolve-on-arrival: Phase-2-hermetic RecordedFixture replay from claim_batch --fixture-store
 // (recorded wet via --record); the published corpus (extdeps.diagnostic.mock_corpus) now governs

diff --git a/dsl/extdeps/diagnostic/ssh.dag b/dsl/extdeps/diagnostic/ssh.dag
@@ -7,6 +7,16 @@ module extdeps.diagnostic.ssh
 
 import std.types { NonEmptyStr }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "datatracker.ietf.org/doc/html/rfc4253"
+  }
+}
+
 // 🟡 dissolved — feature:diagnostic-ssh-mock-response — scaffold:hand-authored mock_response —
 // dissolve-on-arrival: Phase-2-hermetic RecordedFixture replay from claim_batch --fixture-store
 // (recorded wet via --record); the published corpus (extdeps.diagnostic.mock_corpus) now governs

diff --git a/dsl/extdeps/external_authority.dag b/dsl/extdeps/external_authority.dag
@@ -0,0 +1,36 @@
+// extdeps/external_authority.dag — external authority citation carrier (DESIGN §3).
+//
+// Every extdeps/ module cites an EXTERNAL authority — a real URL to a wiki, ISO,
+// ECMA, vendor SPEC page, or other intersubjective framework for the *concept*
+// modeled in the module (not the umbrella company homepage). The locator names the
+// spec surface the module's facts ground on.
+//
+// Canonical module-level data row name (projection + lens match literally):
+//   data extdeps_external_authority_anchor: ExternalAuthority = ...
+//
+// Internal file: anchors are reserved for anchor-machinery modules only
+// (extdeps.uri, extdeps.external_authority) — see lens machinery-exempt roster.
+
+module extdeps.external_authority
+
+import std.types { NonEmptyStr }
+import extdeps.uri { Uri, File }
+
+type ExternalAuthority {
+  uri: Uri
+}
+
+// Field-level override: a specific fact cites a finer locator than the module
+// root (e.g. a page fragment on a PDF). Absent ⇒ inherit module root.
+type FactAuthorityOverride {
+  fact: NonEmptyStr
+  authority: ExternalAuthority
+}
+
+// Self-anchor: DESIGN §3 single-authority (internal doc cited as file: fragment).
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: File
+    locator: "DESIGN.md#3-single-authority"
+  }
+}
diff --git a/dsl/extdeps/external_authority_backfill_pending.txt b/dsl/extdeps/external_authority_backfill_pending.txt
@@ -0,0 +1,126 @@
+extdeps.apt
+extdeps.audit.cloudevents
+extdeps.bmc
+extdeps.bmc.redfish
+extdeps.bmc.types
+extdeps.boards.asrock_rack
+extdeps.boot.emit
+extdeps.boot.framebuffer
+extdeps.boot.freestanding_payload
+extdeps.boot.freestanding_witness
+extdeps.boot.linux_x86_boot
+extdeps.brew
+extdeps.browser
+extdeps.cache.buildbuddy
+extdeps.cache.cache
+extdeps.cache.cargo
+extdeps.cache.catalog_io
+extdeps.cache.catalog_placement
+extdeps.cache.github_actions
+extdeps.cache.key_completeness
+extdeps.cache.rustup
+extdeps.cache.sccache
+extdeps.cache.types
+extdeps.cargo
+extdeps.cargo_build
+extdeps.cargo_version
+extdeps.clock
+extdeps.cloud.cloud
+extdeps.cloud.gcp.errors
+extdeps.cloud.gcp.gcp
+extdeps.cloud.gcp.iam
+extdeps.cloud.gcp.mock_corpus
+extdeps.cloud.gcp.secret_manager
+extdeps.cloud.gcp.sts
+extdeps.container.oci.ctrl_session_witness
+extdeps.container.oci.descriptor
+extdeps.container.oci.image_config
+extdeps.container.oci.linux
+extdeps.container.oci.manifest
+extdeps.container.oci.media_types
+extdeps.container.oci.runtime_config
+extdeps.container.oci.types
+extdeps.cpu
+extdeps.cpu.ampere
+extdeps.cron
+extdeps.cron.mock_corpus
+extdeps.cron.schedule_model
+extdeps.diagnostic.mock_corpus
+extdeps.docker
+extdeps.filesystem.filesystem_io
+extdeps.filesystem.mock_corpus
+extdeps.filesystem.ntfs
+extdeps.filesystem.posix
+extdeps.git
+extdeps.git.mock_corpus
+extdeps.git.object_store
+extdeps.git.versioning
+extdeps.github.actions
+extdeps.github.auth
+extdeps.github.ci
+extdeps.github.errors
+extdeps.github.gists
+extdeps.github.github
+extdeps.github.log_annotations
+extdeps.github.mock_corpus
+extdeps.github.pulls
+extdeps.gitignore
+extdeps.gitignore_render
+extdeps.gnu_coreutils
+extdeps.gunbc
+extdeps.http.server
+extdeps.languages.bash.program
+extdeps.languages.dag.emit
+extdeps.languages.dag.syntax
+extdeps.languages.dag.types
+extdeps.languages.go.emit
+extdeps.languages.go.primitives
+extdeps.languages.go.syntax
+extdeps.languages.go.types
+extdeps.languages.python.emit
+extdeps.languages.python.primitives
+extdeps.languages.python.syntax
+extdeps.languages.python.types
+extdeps.languages.rust.emit
+extdeps.languages.rust.primitives
+extdeps.languages.rust.syntax
+extdeps.languages.rust.types
+extdeps.llm.anthropic
+extdeps.llm.anthropic_errors
+extdeps.llm.anthropic_rest
+extdeps.llm.cli
+extdeps.llm.llm
+extdeps.llm.mock_corpus
+extdeps.llm.openai
+extdeps.llm.openai_errors
+extdeps.llm.openai_rest
+extdeps.memory
+extdeps.memory.jedec
+extdeps.memory.sk_hynix
+extdeps.object_storage
+extdeps.object_storage.content_addressed
+extdeps.os.os
+extdeps.realization.hermetic_fixture
+extdeps.realization.parse_table_memo
+extdeps.realization.resolved_graph
+extdeps.realization.v1_handler
+extdeps.render.glyphs
+extdeps.render.tier_glyphs
+extdeps.runtime.local
+extdeps.rustup
+extdeps.shell
+extdeps.shell.credentials
+extdeps.shell.mock_corpus
+extdeps.sql.migration
+extdeps.test.http_pilot
+extdeps.test.mock_corpus
+extdeps.tools
+extdeps.transports.fidelity
+extdeps.transports.file
+extdeps.transports.rest
+extdeps.transports.shell
+extdeps.transports.sql
+extdeps.toolchain.architecture_profile
+extdeps.version
+extdeps.version.pep440
+extdeps.version.semver
diff --git a/dsl/extdeps/formats/elf/encode.dag b/dsl/extdeps/formats/elf/encode.dag
@@ -55,6 +55,16 @@ import extdeps.formats.elf.types {
 }
 import std.types { Bool }
 
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html"
+  }
+}
+
 data elf_ident_padding_zeros: List<Int> = [0, 0, 0, 0, 0, 0, 0]
 
 fn u8_le_byte(value: Int) -> Int {