What every tree here is, and is not. Each one is derived from what a surface architecturally is — that a command-line agent running under your account reaches what your account reaches is a fact about command-line programs, true of all of them, and it is not a claim about whoever wrote one. Where a node comes from something stronger — a published third-party audit, or a direct measurement — the node says so and carries its date.
Which is why the library names surfaces and offers products as examples within them, rather than grading products. Grading a named product means measuring it, under the participant rules this site applies to every comparison: a verification date, a published re-run method, and the participant named on the page.
The four shapes
Every fact answered yes, so you see the maximum extent of each. In the assessment these get pruned by what you actually have.
What the trees reach
The capability vocabulary the whole tool is built on. Everyday uses are in it deliberately: a tool that only lists frightening capabilities is measuring its own framing.
The controls
What removes capability, and what tier it actually is. A control enforced by the tool — running inside the grant — is a setting, however it is documented.