Software Bill of Materials (SBOM)
Standard: CycloneDX 1.6 (+ SPDX via Syft) · Files: 08_GOVERNANCE/sbom/ · Generated: 2026-06-03
Inventory
| Component | Tool | File | Components | Known vulns (Grype) |
|---|---|---|---|---|
| Python runtime env (Brain + platform) | cyclonedx-py 7.3.0 | python-env-cyclonedx.json | 414 | 14 (4 High / 7 Med / 3 Low) |
| Desktop Control Plane | cyclonedx-npm 4.2.1 | node-desktop-control-plane-cyclonedx.json | 405 | 0 |
| Web Platform | cyclonedx-npm 4.2.1 | node-web-platform-cyclonedx.json | 876 | 6 (3 High / 2 Med / 1 Low) |
| Docs Wiki | cyclonedx-npm 4.2.1 | node-griff-wiki-cyclonedx.json | 1,138 | 3 (1 High / 2 Med) |
| Brain active v2-100 | Syft 1.42.4 | brain-v2-100-syft-{cyclonedx,spdx}.json | 4 | 0 |
| Brain running code | Syft 1.42.4 | brain-frozen-syft-{cyclonedx,spdx}.json | manifests | — |
Aggregate: ~2,837 components · 23 known-vuln matches (8 High / 11 Med / 4 Low) → triage tracked on the board.
Regenerate
# Python env
python -m cyclonedx_py environment C:\Python312\python.exe --output-format JSON > python-env-cyclonedx.json
# Node (lock-only)
cyclonedx-npm --package-lock-only --output-format JSON --output-file node-<pkg>-cyclonedx.json <pkg>\package-lock.json
# Multi-ecosystem + SPDX, and vuln scan
syft scan dir:<path> -o cyclonedx-json=out.json -o spdx-json=out-spdx.json
grype sbom:out.json -o json > vuln-out.grype.json
Toolchain
cyclonedx-bom 7.3.0 (pip) · @cyclonedx/cyclonedx-npm 4.2.1 (npm) · syft 1.42.4 + grype 0.110.0 (choco).
Per-task rule
When a task changes dependencies, regenerate the affected SBOM(s), re-run Grype, and record the file paths on the task's board line. The SBOM set is part of definition-of-done — see the gate.