site: publish the platform guides at /platforms/ and link them from an About page

(cherry picked from commit 408d6cdfd76d13945db1d9727b58feca23d1e48b)

content/about/l3/about-sources.md

@@ -0,0 +1,49 @@
+---
+id: about-sources
+area: about
+level: 3
+title: "What the assistant reads"
+claim: "Four sources, one pool, and a published rule for every one of them."
+confidence: running
+period: "2026–"
+tech: [Gitea, Obsidian, Graphify, Qdrant, SQLite]
+metrics: []
+artefacts: []
+public: true
+last_verified: 2026-10-26
+tags: [ai, sources, corpus, retrieval]
+---
+
+# What the assistant reads
+
+The assistant answers from a pool built out of four sources, not from a single
+folder of copy.
+
+| Source | Tier | What it contributes |
+|---|---|---|
+| This site's content | 1 | The curated claims: what Sam says is true about the work |
+| The Gitea estate | 2 | README files, file trees, selected source files, commit messages and language statistics |
+| The notes vault | 2 | Project and area notes, in Sam's own words |
+| The knowledge graph | 2 | Nodes and edges over the vault, each joined back to the note it came from |
+
+Tier 1 wins when the two disagree. A harvested README can be out of date; the
+curated claim is the one that is maintained.
+
+Every chunk records the platform it came from, the URL or repository path it can
+be opened at, the area it feeds, its tier, its honest confidence and when it last
+changed. A chunk without an origin is refused, not defaulted.
+
+The rules are not hidden in code. Each platform has a guide that says what it is,
+where it lives, what is included, what is excluded and whether it is enabled.
+Those guides are shown at [the sources page](/platforms/) and are the same files
+the ingestion pipeline reads.
+
+## What is excluded
+
+`node_modules`, virtualenvs, git internals, trash, editor state, the SilverBullet
+auth file, credential-shaped files, binaries and media. Media is recorded as an
+image reference and never turned into text. Personal and family notes are not
+read.
+
+The finished pool is scanned for credential-shaped content before a run can
+succeed, so the exclusion list is checked rather than trusted.