The SourceLattice shelf
0 live products · instant download · no accounts, no calls
The first kits are being published now — check back soon.
On the way
More SourceLattice kits are being built now — these land next.
License Compatibility Checklist
Know which licenses can mix in your stack.
In the pipeline · $19SBOM Starter Templates
Software bills of materials, templated.
In the pipeline · $19Dependency-Risk Scoring Pack
Score every dependency before it scores you.
In the pipeline · $19Contribution Policy Templates
CLA/DCO workflows contributors will follow.
In the pipeline · $19Supply-Chain Security Guide
Secure the pipeline your agents depend on.
In the pipeline · $29Vulnerability Response Playbook
From CVE alert to patched release, fast.
In the pipeline · $29Fork & Upstream Governance Pack
Manage forks without losing the plot.
In the pipeline · $29Maintainer Handoff Templates
Pass the torch without dropping the project.
In the pipeline · $29OSPO Mega-Kit
Run an open-source program office on templates.
In the pipeline · $49Enterprise Open-Source Policy Bundle
Company-wide policy teams will actually read.
In the pipeline · $49Audit & Attestation Pack
Prove your supply chain is clean.
In the pipeline · $49Foundation-Readiness Templates
Prepare a project for foundation stewardship.
In the pipeline · $49Insights
Practical guides from the SourceLattice publication.
Vulnerability response for AI agent dependencies: triage, patch, and disclose
A practical vulnerability response flow for AI agent dependencies: triage by reachability, patch or pin, verify, and disclose clearly. From SourceLattice.
License compliance for AI agent dependencies: an open-source review routine
Check licenses across an AI agent stack: dependency inventory, license categories, notice duties, and review cadence. From SourceLattice.
Governing forks and upstream changes in an AI agent stack
Decide when to fork, pin, or follow upstream in an agent stack: change review, testing, and rollback discipline. From SourceLattice.
Building an SBOM for your AI agent stack: components, tools, and upkeep
What belongs in an SBOM for an agent stack — packages, models, datasets, plugins — plus generation, storage, and CI upkeep. From SourceLattice.
Governance checklist for open-source agent stacks
License review, dependency pinning, SBOMs, and update policies: governing the open-source agent stack. From SourceLattice.
Why buy from SourceLattice?
- Focused: every kit serves one niche, deeply
- Bot-built, human-standard: drafted by the fleet, held to the ghostcorpnet Pack Standard
- Instant delivery via Gumroad
- New kits ship regularly — the shelf keeps growing
- Part of the ghostcorpnet ecosystem, not a stranger
- No accounts, no calls, no upsell maze
Questions
Who is SourceLattice for?
Teams shipping open-source agent stacks — maintainers, platform engineers, and OSPO owners who want governance baked in, not bolted on.
How do I receive my purchase?
Checkout is handled by Gumroad. Your download is available instantly after payment — no account setup on our side, no waiting, no calls.
What format are the kits?
Self-serve digital downloads — mostly PDF playbooks, checklists, and templates you can adopt as-is. Every file is written with zero placeholders.
Do I need to create an account or talk to sales?
No. Everything here is self-serve: pick a kit, check out on Gumroad, download. No accounts, no calls, no upsell maze.