The OpenTelemetry org, as a dependency graph.

Reading the two columns.Direct dependents counts distinct active sibling repositories at or above Riftmap's 0.8 confidence floor — the same bar impact mode applies, and the one every figure in the nine-org scan is computed on. All declared references holds that scope and drops only the floor, so the gap between the columns isolates exactly one thing: how much of this org's coupling is declared outright versus inferred. Across the org the floor discards 328 of 461 repo-to-repo pairs. Multiple manifests pointing at the same repository count once. The graph above additionally draws archived repositories, so a node there can show more arrows than either column reports.

What the floor throws away here. A repository can look larger in the graph than it reads in this table, and these are the ones where that gap is worth naming: open-telemetry/opentelemetry-specification loses 46 (bare git URL) ; open-telemetry/semantic-conventions loses 44 (bare git URL) ; open-telemetry/opentelemetry-proto loses 29 (bare git URL) ; open-telemetry/community loses 24 (bare git URL) ; open-telemetry/opentelemetry-collector-contrib loses 17 (Dockerfile FROM, bare git URL) . What those references have in common is that they had to be inferred rather than read: a bare git URL sitting in a shell script or a README is a text signal rather than a declared dependency, and a bare image name has to be guessed back to the repository that publishes it. Riftmap scores both below the floor and never counts them. That is a deliberate choice about what the word "dependency" is allowed to mean, and it costs this org its highest raw numbers.

Check it rather than trust it. Both columns are recomputable from the scan itself: every parsed reference as CSV — including the ones below the floor, each flagged — and the repository list with its archived flags and scan timestamps. Same export the nine-org scan publishes, per org.