[andife]

The generator's completeness report currently has no traceable crosswalk to the G7 AI SBOM minimum elements. This draft adds all 50 elements across seven clusters, a CycloneDX 1.7 mapping, and a separate advisory g7_profile report alongside the existing completeness score.

For example, a software library cannot satisfy model or dataset checks, and one documented model cannot hide another model's missing version. Each assessed element reports its subjects, JSON-pointer evidence, source page, and mapping limitations.

Implementation

• Machine-readable registry with original element names, source sections/pages, scoped evidence groups, and mapping notes.
• CycloneDX 1.7 schema validation before assessment; unsupported, invalid, and non-AI inputs receive no percentage.
• Separate present, partial, missing, unknown, review, and not_assessed results. The project-defined known-evidence percentage uses present / 50; it is not a G7 conformance threshold.
• Model/dataset scoping, nested components, dataset reference resolution, and dependency checks. Arbitrary properties cannot satisfy native checks.
• Existing Basic/Standard/Advanced scoring is preserved. The new JSON registry is included in built distributions.

Source and review boundaries

The element names, cluster membership, and definitions were checked against the original BSI-hosted G7 publication, sections 2.1–2.7, on 18 October 2026. The registry records printed page references and the downloaded PDF's SHA-256:

d0b2f41c5baa2bcb2c8bea5b9d610fe9bafef202bbc42798b0a562eb0db5e77c

The mapping is a draft project interpretation, without approval from G7, BSI, or the CycloneDX working group. Signatures, security controls/certifications, operational metrics, and other semantic checks remain review items. Artifact hashes are not recomputed, signatures are not verified, and external references are not fetched. Model openness is not inferred from a license; the source lists openness as an illustrative example under Model license.

WIP review focus

• Maintainer/AI-ML community review of native, partial, and manual mappings.
• Agreement on reporting explicit unknowns, the fixed denominator, and the initial system/dataset scope.
• Review how the advisory report should be surfaced in CLI/web output; this draft exposes it through the existing scoring result.
• Reconcile package-data configuration with fix(packaging): include runtime data in distributions #112 depending on merge order.

Validation

• Full suite: 216 passed, plus 28 subtests passed (python -m pytest --no-cov -p no:cacheprovider -o addopts= -q). Existing dependency/deprecation warnings remain.
• Targeted G7/scoring suite: 39 passed, covering unrelated components, incomplete cohorts, dataset arrays/references, unknowns, malformed inputs, signatures, security.txt, and KPI semantics.
• Ruff passes for the new evaluator and tests; git diff --check passes.
• Built a wheel, checked registry inclusion/content, and successfully assessed a fixture from the unpacked wheel in an isolated Python process outside the checkout.

The current upstream default branch is main; the contribution guide's v0.2 branch is no longer present.