OOF® Origin Open Foundation®

Independent Methodological Authority

Architecture: SLGA™ — Software Lifecycle Governance Architecture
Parent Standard: Software Dependency Standard (SDS)
Category: Governance & Enforcement
Subcategory: Software Lifecycle Governance
Type: Core Module
Governed Space: Software Component Identification Governance
Module ID: SLGA-SDS-CIM-001
Origin ID: OOF.CM.SLGA.03.01.01
Version: 1.0
Status: Canonical · Open Standard
Effective Date: 11.10.2026
Compatibility: OOF® Methodology OS™ · Modular OOF® Architecture Ecosystem
GIE-Compatible: Yes
AI-Readable: Yes
Authority: OOF® — OriginOpen® Foundation
Protection: MIP® — Methodological Intellectual Property
Canonical Language: English (UCL™)

Canonical Definition

The Component Identification Module (CIM) governs how software components

CIM establishes the methodological conditions under which a software

It governs the relationship between the dependent software object, the

CIM distinguishes component discovery from component identification,

It applies to software libraries, packages, frameworks, plugins, runtime

Governed Software Component Identification State

Operational Role

It establishes the identifiable dependency objects upon which those

Core Question

Position in Architecture Governance Flow

Software Requirements → Software Creation → Software Dependencies →

Software Lifecycle Control

Software Dependency Standard (SDS)

Component Identification → Dependency Origin & Traceability → Dependency

Component Identification

Governed Software Requirements Baseline

Governed Software Creation State

Governed Software Component Identification State

DOTM — Dependency Origin & Traceability Module

• Governed Space

Software Component Identification Governance

This space governs the recognition and identification of material software

• Dependent software object identification
• Component discovery
• Component recognition
• Component identity
• Component distinguishability
• Component classification
• Dependency relationship identification
• Direct and indirect dependency recognition
• Version and state identification
• Component role identification
• Component boundary identification
• Component occurrence and instance recognition
• Generated and dynamically resolved components
• Identification evidence
• Identification uncertainty
• Identification conflicts
• Identification gaps
• Identification drift
• Identification continuity
• Identification governance states

Component Identification Governance Object

Every CIM assessment shall establish a Component Identification Governance

The object represents a software component or dependency resource whose

Dependent Software Object: The software system or subsystem under

Component Role: The function performed in relation to the dependent

Occurrence Context: The environment or scope in which the component

Identification Governance State: The current recognized identification

The identification object shall remain distinguishable from the underlying

Dependent Software Object Identification

• An application
• A software service
• A software component
• A software platform
• A development tool
• A build system
• A generated software artifact
• An autonomous software system
• A defined software subsystem

The dependent software object shall be sufficiently identified to establish

Component Discovery

CIM shall support discovery of material software components and dependency

• Package manifests
• Lockfiles
• Repository contents
• Build definitions
• Runtime observations
• Software composition records
• Service integration records
• Generated code
• Dependency scanners
• Deployment configurations
• Relevant development evidence

A discovery result shall not automatically be recognized as a sufficiently

Component Recognition

CIM shall establish whether a discovered resource qualifies as a material

• Whether the resource is identifiable
• Whether a material reliance relationship exists or is claimed
• The relevant software context
• The component's functional or operational role
• The available evidence
• Material uncertainty

Component Identity

CIM shall establish sufficiently distinguishable identities for material

• Component name
• Package identifier
• Artifact identifier
• Service identifier
• Component version
• Distribution reference
• Repository reference
• Relevant content identifier
• Component namespace
• Component-specific identification evidence

Identity shall be sufficiently precise to distinguish materially different

Component Identity Granularity

CIM shall establish the identification granularity appropriate to the

• Software product
• Package
• Library
• Module
• Plugin
• Service
• Component instance
• Build artifact
• Runtime artifact
• Relevant software version

Component Classification

CIM shall classify components according to their relevant software

Library: Reusable software functionality incorporated or invoked by other

Framework: Software structure or services supporting application

Build Component: Software resource required during compilation,

Service Dependency: External or internal service upon which the software

Platform Dependency: Software platform or environment supporting the

Generated Component: Software component produced by a generation

Component Role Identification

• Functional execution
• Data processing
• Communication
• Authentication support
• User interface
• Storage access
• Compilation
• Testing
• Generation
• Runtime support
• Integration
• Monitoring

Direct Dependency Identification

CIM shall identify material components directly relied upon by the

• Explicit imports
• Declared packages
• Linked libraries
• Service integrations
• Runtime requirements
• Direct tool invocation
• Explicit platform reliance

A direct dependency shall remain distinguishable from its transitive

Transitive Dependency Identification

Dependent Software → Direct Component → Transitive Component

A component shall not be excluded solely because it was introduced

Nested Dependency Identification

CIM shall support identification of dependency relationships extending

Application → Framework → Library → Runtime Component → Supporting Service

Dynamic Dependency Identification

• Runtime-loaded plugins
• Dynamically linked libraries
• Environment-dependent packages
• Remote service discovery
• Conditional component loading
• Automated dependency resolution

A static dependency record shall not automatically be treated as a complete

Generated Component Identification

• AI-generated libraries
• Generated code modules
• Automated client libraries
• Generated interface implementations
• Code generator outputs
• Autonomous development artifacts

Identification shall preserve the component's distinguishable identity and

Embedded Component Identification

• Bundled libraries
• Vendored source code
• Embedded runtime modules
• Copied software components
• Statically linked components

CIM shall distinguish the embedded component from the composite artifact

Composite Artifact Identity ≠ Complete Constituent Component

External Service Dependency Identification

CIM shall identify material software services upon which a software system

• Service identity
• Interface reference
• Service role
• Dependent software context
• Relevant endpoint or service identifier
• Evidence of actual reliance

Platform Dependency Identification

• Operating systems
• Runtime platforms
• Application servers
• Database platforms
• Container runtimes
• Software execution environments
• Managed software platforms

Identification shall preserve the relationship between the dependent

Development and Build Dependency Identification

• Compilers
• Build tools
• Code generators
• Testing frameworks
• Package resolution tools
• Development services
• Automated build environments

Component Version Identification

• Declared version
• Resolved version
• Installed version
• Executed version
• Build version
• Distribution version
• Relevant content reference

Component Instance Identification

• Development environment
• Build environment
• Testing environment
• Production environment
• Multiple service instances
• Separate application deployments

Component Boundary Identification

• What constitutes the component?
• Which artifacts belong to it?
• Which elements are separate dependencies?
• Is the component embedded or independently distributed?
• Does the identified object represent a package, service, or
  composite

Component Relationship Identification

• Direct reliance
• Indirect reliance
• Runtime invocation
• Build participation
• Service consumption
• Component embedding
• Shared platform reliance
• Conditional use
• Alternative use

Identification shall distinguish observed relationships from claimed or

Component Identification Across Environments

• Development
• Testing
• Build
• Staging
• Production
• Maintenance

A component discovered in one environment shall not automatically be

Component Identification Evidence

• Package manifests
• Lockfiles
• Build records
• Runtime observations
• Service integration records
• Repository evidence
• Artifact identifiers
• Component inventories
• Composition records
• Tool-generated reports

Identification Evidence Competence

Identification Evidence Integrity

• Evidence source
• Content integrity
• Temporal relevance
• Version correspondence
• Preservation history
• Material contradictions
• Evidence completeness

Declared and Observed Components

CIM shall distinguish declared components from components actually observed

• Declared and observed
• Declared but not observed
• Observed but not declared
• Conditionally observed
• Historically observed
• Identification unresolved

Component Identification Completeness

CIM shall assess whether material components have been sufficiently

• Direct dependencies
• Transitive dependencies
• Runtime components
• Build dependencies
• Generated components
• Embedded components
• External services
• Platform dependencies

Component Identification Consistency

• Contradictory versions
• Inconsistent component names
• Different artifact identities
• Conflicting dependency roles
• Incompatible environment records
• Contradictory component boundaries

Component Identification Uncertainty

• Component identity is incomplete
• Version information is missing
• Component boundaries are unclear
• Runtime reliance cannot be established
• A service identity is ambiguous
• Generated components lack sufficient identifiers
• Transitive relationships remain unknown

Component Identification Conflict

• Different versions reported for the same execution context
• Contradictory component identifiers
• Conflicting runtime and manifest records
• Incompatible component boundaries
• Disagreement between build evidence and delivered artifacts

Component Identification Gap

• An unknown runtime library
• An unrecognized external service
• A missing transitive component
• An embedded library with uncertain identity
• A generated component without a distinguishable version
• An unidentified build dependency

Critical Component Identification Gap

• An unidentified component supporting a critical software
  function
• An unknown library embedded in safety-relevant software
• A critical external service whose actual identity cannot be
• An unrecognized transitive component essential to system
  operation

Component Identification Drift

• Automatic updates
• Dynamic dependency resolution
• Unrecorded component replacement
• Runtime environment changes
• Generated code changes
• Service substitutions
• Build configuration changes

Previously Identified Component Set ≠ Permanently Identified Component

Component Identification Change

• Newly discovered components
• Corrected identities
• Version changes
• Revised component boundaries
• Changed dependency roles
• Removed components
• New evidence
• Resolved conflicts

Component Identification Continuity

CIM shall preserve material component identity relationships across

• Software version changes
• Repository migrations
• Package source changes
• Development environment changes
• Runtime environment changes
• Component replacement
• Supplier changes
• Software modernization

Component Identification Governance States

Partially Identified: Some material identification dimensions remain

Relationship-Unresolved: The component's dependency relationship cannot

Identification-Failed: Applicable identification conditions have been

These states shall not be interpreted as dependency acceptance or software

Component Identification Recognition

CIM shall determine whether a material component has been sufficiently

• Component identity
• Classification
• Role
• Version
• Boundary
• Dependent software context
• Relationship evidence
• Occurrence context
• Evidence competence
• Evidence integrity
• Uncertainty
• Conflicts
• Continuity

Recognition shall remain limited to the component and relationship

Component Identification and Origin

DOTM — Dependency Origin & Traceability Module

Component Identification and Suitability

DSM — Dependency Suitability Module

Component Identification and Introduction Authority

CICM — Component Introduction & Change Module

Component Identification and Continuity

DCRM — Dependency Continuity & Risk Module

Component Identification and Operational Reality

CIM shall distinguish declared dependency information from the components

• Load undeclared runtime components
• Invoke external services
• Use dynamically resolved libraries
• Execute embedded code
• Rely on platform components absent from application manifests

Component Identification Reassessment

• New dependency discovery
• Version changes
• Software modifications
• Build changes
• Runtime changes
• Generated component changes
• New service integrations
• Evidence conflicts
• Component identification drift
• Dependency relationship changes

Governed Software Component Identification State

Governed Software Component Identification State

Identification Governance Object: The component or relationship under

Identification Consistency: The compatibility of material identification

Critical Identification Gaps: Material identification failures requiring

Identification Governance State: The current recognized identification

Continuity: Preservation of component identity relationships across

Downstream References: Information required by competent SDS governance

The state shall not independently establish dependency suitability,

Minimum Implementation Framework

• Dependent Software Object and Component Discovery Governance

Capability to identify the dependent software object, establish discovery

• Component Identity, Classification, and Boundary Governance

Capability to establish distinguishable component identities, versions,

• Dependency Relationship, Occurrence, and Environment Governance

Capability to identify material reliance relationships, distinguish direct

• Component Identification Evidence and Recognition Governance

Capability to associate identification claims with competent evidence,

• Identification Gap, Conflict, Drift, and Continuity Governance

Capability to identify material gaps, critical gaps, conflicting component

• Governed Component Identification State and SDS Handoff
  Governance

Capability to produce a Governed Software Component Identification State

GIE™ Compatibility

• Component discovery
• Dependency candidate identification
• Component identity normalization
• Component classification
• Component role identification
• Direct dependency recognition
• Transitive dependency discovery
• Nested dependency mapping
• Dynamic dependency identification
• Generated component recognition
• Embedded component recognition
• Service dependency identification
• Platform dependency identification
• Build and development dependency identification
• Version correlation
• Component instance identification
• Component boundary analysis
• Cross-environment component comparison
• Identification evidence association
• Identification completeness assessment
• Identification consistency assessment
• Identification gap detection
• Critical identification gap detection
• Identification conflict analysis
• Identification drift detection
• Component identity continuity assessment
• Governed identification state representation

Such outputs shall remain distinguishable from sufficiently evidenced

OOF® logic adapts to the governed reality. The engine adapts to OOF®

Governance Logic

Receive Governed Software Requirements Baseline

Receive Governed Software Creation State

Identify Component Identification Governance Object

Identify Dependent Software Object

Establish Component Discovery Scope

Discover Candidate Components and Dependency Resources

Identify Direct and Transitive Dependency Candidates

Identify Generated, Embedded, Dynamic, Service, and Platform Components

Establish Component Identity

Identify Component Classification and Role

Establish Component Version or State

Establish Component Boundary

Identify Component Occurrence and Environment

Identify Material Dependency Relationships

Associate Component Identification Evidence

Assess Evidence Competence and Integrity

Assess Identification Completeness

Assess Identification Consistency

Identify Identification Gaps and Critical Gaps

Identify Identification Conflicts and Uncertainty

Identify Component Identification Drift

Determine Component Identification Governance State

Establish Governed Software Component Identification State

Preserve Component Identification Continuity

Handoff to DOTM and Competent SDS Governance

Governed Software Component Identification State

Governance Outputs

Component Identification Governance Object

Dependent Software Object Reference

Component Discovery Scope Record

Candidate Component Inventory

Component Recognition Record

Component Identity Record

Component Identity Granularity Assessment

Component Classification Record

Component Role Record

Direct Dependency Identification Record

Transitive Dependency Identification Record

Nested Dependency Map

Dynamic Dependency Identification Record

Generated Component Identification Record

Embedded Component Identification Record

External Service Dependency Identification Record

Platform Dependency Identification Record

Development and Build Dependency Identification Record

Component Version Identification Record

Component Instance Identification Record

Component Boundary Record

Component Relationship Record

Cross-Environment Component Identification Record

Component Identification Evidence Record

Identification Evidence Competence Assessment

Identification Evidence Integrity Assessment

Declared and Observed Component Comparison

Component Identification Completeness Assessment

Component Identification Consistency Assessment

Component Identification Uncertainty State

Component Identification Conflict Record

Component Identification Gap

Critical Component Identification Gap

Component Identification Drift Record

Component Identification Change Record

Component Identification Continuity Record

Component Identification Governance State

Component Identification Recognition Record

Component Origin Reference

Component Suitability Reference

Component Introduction Authority Reference

Component Continuity Reference

Operational Reality Identification Reference

Component Identification Reassessment Record

SDS Identification Handoff Record

Governed Software Component Identification State

Critical Distinctions

Component Discovery ≠ Governed Component Identification

Component Identification Object ≠ Component Artifact

Dependency Role ≠ Permanent Component Classification

Candidate Component Recognition ≠ Verified Component Identity

Component Name ≠ Governed Component Identity

Identification Detail ≠ Identification Adequacy

Component Type ≠ Component Governance State

Component Identity ≠ Component Role

Direct Dependency Declaration ≠ Complete Direct Dependency Identification

Indirect Introduction ≠ Absence of Material Reliance

Known Dependency Root ≠ Complete Dependency Chain

Static Dependency Manifest ≠ Actual Runtime Dependency Set

Generated Component Existence ≠ Sufficiently Identified Component

Composite Artifact Identity ≠ Complete Constituent Component

No Installed Package ≠ No Software Dependency

Application Portability Claim ≠ Absence of Platform Dependency

Runtime Absence ≠ Development Dependency Irrelevance

Declared Version ≠ Actual Component Version

Component Identity ≠ Component Instance Identity

Package Boundary ≠ Necessarily Component Boundary

Recorded Component Association ≠ Established Dependency Relationship

Development Dependency Set ≠ Production Dependency Set

Component Inventory Entry ≠ Verified Component Identification

Evidence Availability ≠ Evidence Competence

Evidence Integrity ≠ Identification Validity

Declared Component Set ≠ Observed Component Set

High Discovery Coverage ≠ Complete Component Identification

Consistent Component Records ≠ Verified Component Reality

Uncertain Component Identity ≠ Verified Component Identity

Identification Conflict ≠ Permission to Select an Unsupported Identity

Missing Component Identification ≠ Proven Component Defect

Critical Identification Gap ≠ Automatic Software Rejection

Previously Identified Component Set ≠ Permanently Identified Component Set

Identification Correction ≠ Historical Identification Erasure

Name Continuity ≠ Component Identity Continuity

Component Identified ≠ Dependency Accepted

Recognized Component Identity ≠ Complete Dependency Governance

Component Identity ≠ Verified Component Origin

Component Identification ≠ Dependency Suitability

Component Presence ≠ Authorized Component Introduction

Component Identification ≠ Dependency Continuity Assurance

Declared Dependency Inventory ≠ Complete Operational Dependency Reality

Cross-Architecture Boundary

CIM — Component Identification Module identifies material software

DOTM — Dependency Origin & Traceability Module governs origin,

DSM — Dependency Suitability Module governs necessity, compatibility, and

CICM — Component Introduction & Change Module governs introduction

DCRM — Dependency Continuity & Risk Module governs criticality, risks,

Software Creation Standard (SCS) governs software creation and artifact

Software Change Management Standard (SCMS) governs broader lifecycle

Software Lifecycle Control Standard (SLCS) governs cross-cutting

OBIDENITY® — Origin-Bound Identity Governance Architecture: Relevant

ORA™ — Operational Reality Architecture: Competent operational reality

CIM preserves component identification relationships without replacing the

Canonical Boundary

• Component identification governance objects
• Dependent software object identification
• Component discovery
• Component recognition
• Component identity
• Identification granularity
• Component classification
• Component roles
• Direct dependencies
• Transitive dependencies
• Nested dependency relationships
• Dynamic dependencies
• Generated components
• Embedded components
• External service dependencies
• Platform dependencies
• Development and build dependencies
• Component versions
• Component instances
• Component boundaries
• Component relationships
• Cross-environment identification
• Identification evidence
• Evidence competence
• Evidence integrity
• Declared and observed components
• Identification completeness
• Identification consistency
• Identification uncertainty
• Identification conflicts
• Identification gaps
• Critical identification gaps
• Identification drift
• Identification changes
• Identification continuity
• Identification governance states
• Identification recognition
• Component origin references
• Component suitability references
• Component introduction authority references
• Component continuity references
• Operational reality identification references
• Identification reassessment

• Complete dependency provenance
• Dependency necessity
• Dependency suitability
• Dependency introduction authority
• Dependency acceptance
• Software component security
• Software functional correctness
• Dependency continuity
• Software release readiness
• Deployment authorization
• Legal liability

Governed Software Component Identification State

with sufficient identity, classification, version, role, relationship,

Use Case 1 — An AI-Generated Application Contains an Undeclared

An organization uses an AI coding assistant to generate a business

The generated application contains a package manifest listing its software

However, part of the generated code makes runtime requests to an external

Dependent Software Object → Discovered Components → Runtime Service

• The package manifest does not represent the complete dependency
  set
• A material service dependency exists outside the declared
  package
• The service must be sufficiently identified before its origin,

Partially Identified

Relationship-Unresolved

Use Case 2 — A Critical Software System Contains an Unidentified

The supplier provides the application, documentation, and a list of

Its relationship to the delivered software artifact has not been

The organization cannot competently assess the component's origin,

Delivered Software Artifact → Embedded Component → Component Boundary →

• The embedded library is a material constituent component
• Its absence from the declared dependency inventory does not
  eliminate
• The available evidence is insufficient to establish the precise
• Downstream dependency governance requires an explicit
  identification

Version-Unresolved

Evidence-Limited

Composite Artifact Identity ≠ Complete Constituent Component

The result: CIM prevents an apparently complete software inventory from

Canonical Closing Statement

Composite Artifact Identity ≠ Complete Constituent Component

CIM establishes the first methodological requirement of software dependency

A software dependency cannot be competently governed while the component

This requirement applies regardless of whether the component was selected

It establishes the identifiable objects and relationships required for

CIM transforms software component discovery into governed dependency