Every target becomes a line in the CBOM.
Probes, runtime inventory and scanner output, from our tools or the ones you already run, enter through one CycloneDX 1.6 ingest. The inventory's hash is signed into the plan, and a signed scope statement declares coverage and every scan that failed.
- What was not scanned is said out loud
- Scanner signatures are never treated as evidence; only the engine signs
Order the work by how long it must last.
The scheduler weighs data lifetime, exposure and algorithm strength, and signs its verdict. The plan references that verdict, so anyone can later check why one system went before another.
- Longest-lived secrets and longest-trusted signatures first
One target, one change, everything on the record.
A signed plan fixes scope, target and steps; a signed approval records who allowed it and when the approval lapses. Each change is a transition receipt: what it moved from and to, how long old and new ran side by side, whether a downgrade was caught, and any rollback with its reason.
- Peers that are not ready keep working; every fallback is recorded
- A trail with no rollbacks should raise questions, not settle them
Close the plan, honestly, and hand over the bundle.
The close receipt states what was planned, executed, failed and deferred, with the CBOM after. The bundle verifies offline, and a non-author re-runs it before it counts. Absence of evidence is never reported as evidence of absence.
- Bundle rules exist in JavaScript; the Python bundle verifier is open work
- Bundles are not yet anchored