source track formatting should follow the slsa project standards

[TomHennen]

Apologies for being late to review this. It's fantastic to see the beginnings of a Source track emerge. Thank you for the continued effort on this @kpk47.

This feels equivalent to what we had in v0.1, only compressed into 3 levels instead of 4 and with more affordances for changes from robots. Does that assessment feel fair/accurate to you?

Most of my comments are related to presentation, the requirements feeling so close to the v0.1 version is a great baseline.

The formatting and structure of the Levels changes don’t match the existing Build track levels.
Build levels are broken down into producer and platform requirements (see change from benefits to focus in cc812c3) and are a descriptive overview requirements, whereas the newly added source requirements are detailed and specific enough that they run the risk of seeming authoritative and contradictory to the track text.

The formatting and structure of the Source requirements doesn’t match the “Producing artefacts” document, where the requirements are in a table with check marks for which level they apply to (and further, there are tables per requirement category: provenance generation and isolation, I’m not sure this split makes sense for the source track).

Note: we should update future-directions to remove the source track and/or update it to mention what could come next. Threats and mitigations should be updated too.

Final thought, is adding a new level appropriate for a minor release, or should we consider a major release for this?

Originally posted by @joshuagl in #1037 (review)

[TomHennen]

Also see the discussion here.

I believe @Nikokrock is working on fixing this.

[zachariahcox]

I don't have permission to edit this title @TomHennen but we should probably rename this: "source track formatting should follow the slsa project standards"