Skip to content

Boms - #218

Open
JEJodesty wants to merge 11 commits into
mainfrom
boms
Open

Boms#218
JEJodesty wants to merge 11 commits into
mainfrom
boms

Conversation

@JEJodesty

@JEJodesty JEJodesty commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

Lands BOM projections on CAT Node: SPDX 3, CycloneDX, DCAT 3, Syft JSON, and SysML v2 of the Architectural Quantum as CAS objects cited by *_uri. They stay off the signed ExecutionBom. Factory still executes the Order only — it never reads .sysml or a Flexo endpoint.

Projections (cats.network.bom)

  • Catalog-first project_bom plus per-view helpers (project_function_source, project_structure_source, project_structure_runtime, project_input_data, project_data_lot, project_sysml_quantum, project_allocate_view).
  • Package URLs via fru_purl. Syft catalogs Plant images and is fail-open if the binary is missing.
  • Optional rtm extra (rdflib / pyshacl) plus shipped SHACL shapes under cats.network.bom.shapes. Flexo persist stays out of scope.

Stems (flag-off by default)

  • CATS_SBOM=1 attaches Order eBOM stems on mint / link* and Invoice runtime_sbom_uri from the Executor.
  • Missing stems stay legal (old Orders execute). A present-but-unfetchable stem fails closed, same as data_uri.
  • put_dir skips terraform / .applied residue so plant and infrastructure tree hashes stay stable after Structure apply.

Carried from #217

  • W3C workstream label anchors (6d–6s) and CAS / *_uri / ni: wording.
  • Registry-first demo as the primary walk.

Docs / demos

  • Docs split into architecture/, guide/, provenance/, and storage/; README, Makefile, and comments retargeted.
  • Living walk: notebooks/cats_bom_projections_demo.py. Lineage walk renamed new_cats_democats_lineage_demo.

Dependencies

  • Optional: uv sync --extra rtm (or --group dev, which already pins rdflib / pyshacl).
  • Optional runtime: CATS_SBOM=1 for stem mint; Syft on PATH for Plant-image catalog.
  • Demos / live Node: existing ops extra (uv sync --extra ops --group dev).

JEJodesty and others added 11 commits September 2, 2026 18:10
docs(W3C): document 6d–6s headings so other docs can link
 URI-only, hl:, and CAS-only Node
docs: replace CID-centric wording with *_uri / ni: /
 CAS-over-HTTP; point §6x refs at W3C.md labels
Promote registry-first demo and retarget docs to CAS / W3C
chore(deps): rdflib/pyshacl for RTM; ship cats.network.bom
 shapes TTL via package-data
feat(bom): purl, SPDX/CDX/DCAT/SysML projectors, Syft,
 RTM Dataset/SHACL shapes, and read helpers
feat(packaging,cas): skip terraform/.applied noise when
 hashing plant/infrastructure trees; export helper
feat(order,executor,registry): attach Order SBOM stems and
 Invoice runtime_sbom when CATS_SBOM; project into BomRegistry
test(bom): P1–P7 unit suites; extend content-equiv and
 structure root coverage for SBOM stems
feat(demo): cats_bom_projections_demo for §6u; rename
 new_cats_demo to cats_lineage_demo; update scan paths
refactor(docs): move under architecture/guide/provenance/
 storage; retarget README, Makefile, and code comments
docs(guide): wrap coverage and session links in backticks;
 flatten Session 1–2 list indent
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant