chore: init vm-cc compliance scaffold

config/sources.yaml

@@ -0,0 +1,33 @@
+# Define evidence sources and where collectors should look.
+# Keep paths external to code so collectors are layout-agnostic.
+
+vm_skills:
+  path: "../vm-skills"
+  evidence:
+    - "*/outputs/status_matrix.json"
+    - "*/outputs/audit_report.md"
+    - "*/outputs/PROOF.json"
+    - "*/outputs/ROOT.txt"
+
+ops:
+  path: "../ops"
+  evidence:
+    - "20-identity/**"
+    - "60-backups/**"
+    - "70-audits/**"
+
+vm_ledger:
+  path: "../vm-ledger"
+  evidence:
+    - "log/entries.cborseq"
+    - "ledger-cli verify --format json"  # command invocation placeholder
+
+vm_mcp:
+  path: "../vm-mcp"
+  evidence:
+    - "governance/constitution.lock"
+
+vm_contracts:
+  path: "../vm-contracts"
+  evidence:
+    - "receipt_v1.schema.json"