feat(vendor): add The Graph + pattern: Reproducible Audit Extraction

[p-diogo]

What are you adding?

• Vendor/Protocol
• Enterprise Use Case
• Update to existing content
• Pattern

Description

Adds vendors/the-graph.md and patterns/pattern-reproducible-audit-extraction.md.

The gap

Several cards assume a read leg without naming it. pattern-l2-encrypted-offchain-audit, pattern-regulatory-disclosure-keys-proofs and pattern-commit-and-prove all depend on someone serving the anchors an auditor checks a disclosure against, without saying who does that or what makes it trustworthy.

The pattern

Reproducible Audit Extraction fills that in: deterministic extraction to content-addressed inputs, a versioned transform, and a re-execution manifest, so a verifier can re-derive the figure byte-identically and pin any disagreement to a specific input or code version.

No implementation is named in the body, composes_with points at four of your cards, and open_source_implementations lists six tools, three of which aren't ours.

The limits are stated rather than implied: re-execution is the trust mechanism, a serving layer never replaces it, completeness covers on-chain emissions rather than off-chain reality, and attestations are signatures rather than validity proofs.

The vendor entry

We build one implementation of it. The card grades itself down where that's accurate: query privacy is absent, there is no SLA, and hosted delivery reintroduces single-operator trust.

On CROPS

I left the per-card table out because it looks like you've moved away from it. #130 added QA-AUDIT.md, whose item 6 settled on 2026-06-24 to treat CROPS as a selection guideline rather than per-card scoring, and the same PR stripped the inline profile from vendors/peer.md.

Also, the vendor _template.md still shows the table, though it hasn't changed since March. Either way the four dimensions are covered in the card's prose. Happy to add the table if you would rather have it.

Checklist

• I've checked this doesn't duplicate existing content
• All links work
• Info is accurate