World Models · public research draft

Software Product

Describe a software product in full context so an agent can identify it, know what it is made of, what rights and obligations attach to it, where it actually runs, how long it is supported, and what evidence backs every claim.

AI YAML AGENTS.md Research evidence

Research draft. The Claude + Grok synthesis is public for review and use with caution. It passed structural validation but is not yet a canonical Vercy release because the source and coverage holds below remain open.

Catalogue IDWM-SFT-001

Version0.3.0-research.1

Previous version-

Typeaggregate

ValidationPassed

Synthesis digestsha256:7236cf7639493d75…

22Sources

7Bundles

14Layers

30Findings

107Questions

30Artifacts

Format-independent logical structure

Bundles → Layers → Findings → Questions + Artifacts

identity-and-classificationIdentity and Classification2 layers

Fixes what the product is, who is accountable for it, how it is typed, and which external coordinates denote it.

product-identityProduct Identity3 findings

The stable identity of the product as an offering, independent of any single release, package or deployment.

product-identity-record

Product Identity Record

The authoritative record that fixes the product's master-system identifier, canonical name, issuing namespace, producer of record and the criterion separating it from adjacent offerings.

Questions

Which identifier is the authoritative master-system identifier for this product, and which system issued it?identity
Expected answer
- issuing system name
- identifier value
- identifier scheme reference
- assignment timestamp
Within which namespace is the canonical product name unique, and which marketing or legacy names alias it?definition
Expected answer
- canonical name
- namespace reference
- alternate and legacy names
Which organization is accountable as producer or supplier of record for this product?ownership
Expected answer
- producer organization reference
- role code (producer, supplier, distributor)
- accountability start time
Where does this product stop, and which adjacent offerings are separate products rather than editions of this one?composition
Expected answer
- sibling product references
- edition list
- stated separation criterion

Artifacts

Product identity cardThe canonical record instance carrying the master key, namespace, canonical and alternate names, producer reference and separation criterion.

identifier-coordinates-and-crosswalk

Identifier Coordinates and Crosswalk

Ecosystem-facing coordinates that let external systems match this product and its releases (Package URL, CPE, SWID, download location, content identifiers), plus the mapping and precedence between them.

Questions

What Package URL type, namespace, name and qualifiers identify the distributed form of this product?identity
Expected answer
- purl type
- purl namespace and name
- qualifier set
- canonical purl string
Which CPE names are asserted to denote this product, and who asserted them?interoperability
Expected answer
- CPE name
- dictionary status
- asserting party
- assertion time
Where two identifier schemes disagree about the product boundary, which scheme is authoritative for which use?decision
Expected answer
- use case
- authoritative scheme
- precedence rationale
How is a claimed coordinate verified against the published artifact before it is trusted?validation
Expected answer
- verification method
- verifier identity
- verification outcome

Artifacts

Identifier crosswalk tableMapping between the product master key and each external coordinate, with asserting party, validity window and precedence for matching.

product-family-edition-and-sku

Family, edition, channel and SKU

CoSWID software-meta separates product, product-family, edition, channel-type, colloquial-version and revision from the exact software-version. CSAF product trees use vendor/product/version branches, product groups and relationships among products. These group commercial variants (enterprise versus standard, OEM versus academic, LTS line) without treating each SKU as an unrelated product or collapsing them into a single version.

Questions

Which product family, edition and colloquial version line does this offering belong to, and which sibling editions share the same code base?composition
Expected answer
- product-family
- edition
- colloquial-version
Which distribution or licensing channel (OEM, academic, retail, volume or other) applies to this offering?classification
Expected answer
- channel-type
Which CSAF product group, if any, collects this product with related products for common advisory or remediation status?relationship
Expected answer
- product-group-id

Artifacts

Product tree branchFamily/edition/channel branch locating this offering inside a producer product tree.

classification-and-stewardshipClassification and Stewardship2 findings

How the product is typed and what purpose it serves, and who is entitled to speak for each slice of its record.

software-classification-and-purpose

Software Classification and Purpose

Controlled typing of the software (component type, primary and additional purpose, delivery model, regulatory class) that determines which downstream profiles and obligations apply.

Questions

Which component type from the governing BOM vocabulary applies to this product?classification
Expected answer
- component type code
- governing vocabulary and version
- assigning party
What primary purpose and additional purposes does the released artifact serve?definition
Expected answer
- primary purpose code
- additional purpose codes
- purpose rationale
Is the product delivered as an installable artifact, an appliance image, or a hosted service, and does that change which BOM type applies?interoperability
Expected answer
- delivery model code
- applicable BOM type
- degradation notes where no artifact exists
Is the product classified as important or critical under an applicable product-security regime?requirement
Expected answer
- regime reference
- class assigned
- classifying authority or self-assessment flag

Artifacts

Classification assignment recordRecord of each classification assigned, the vocabulary and version used, the assigning party and the time of assignment.

producer-and-stewardship

Producer Accountability and Record Stewardship

The split of ownership and authority over the record: producer-side release facts versus operator-side deployment facts, who may publish binding statements, and what happens when stewardship lapses.

Questions

Which role owns each slice of this record: producer, supplier, distributor or operator?ownership
Expected answer
- record slice reference
- owning role
- owner package reference
Who is authorised to publish a binding statement about this product, and under what delegation?authority
Expected answer
- authorised party
- delegation reference
- statement classes covered
Is the author of a given record the same party as the software producer, and how is the difference recorded?provenance
Expected answer
- author reference
- producer reference
- relationship flag
What becomes of stewardship if the producing organization is acquired, dissolved or abandons the product?exception
Expected answer
- succession rule
- fallback steward
- abandonment state code

Artifacts

Stewardship assignmentThe governing record of who owns, may write to, and may publish from each slice of the product record.

release-and-distributionRelease and Distribution2 layers

The published version lineage of the product and the channels, conditions and cryptographic evidence under which each release reaches a consumer.

release-lineageRelease Lineage3 findings

Individual published releases, their version strings, states, publication events and the scheme that makes versions comparable.

release-record

Release Record

One published version of the product: its version string, publication event time and observation time, distribution channel, state and supersession links.

Questions

What exact version string identifies this release, and is that string immutable once published?identity
Expected answer
- version string
- immutability flag
- issuing system
When was the release published, and is that time distinct from when this record observed it?temporal
Expected answer
- publication event time
- observation or ingestion time
- time source
What is the release's current state: pre-release, generally available, superseded, withdrawn or yanked?state
Expected answer
- release state code
- state effective time
- state-setting party
Which event withdrew or re-published this release, and what release replaced it?event
Expected answer
- event type
- event time
- reason code
- replacing release reference

Artifacts

Release manifestThe published description of a release: version, publication time, channel, contained distributable artifacts and release notes.

version-scheme-and-ordering

Version Scheme and Ordering

The declared versioning scheme and precedence rules that make version comparison, dependency ranges and affected-range statements decidable rather than guessed.

Questions

Which versioning scheme governs this product line, and is it declared by the producer or inferred by a consumer?classification
Expected answer
- version scheme code
- declared or inferred flag
- scheme specification reference
How is precedence determined between two versions, including pre-release identifiers and build metadata?constraint
Expected answer
- ordering algorithm
- pre-release handling
- build-metadata handling
What change classes force a major increment, and what compatibility promise attaches to minor and patch increments?requirement
Expected answer
- change class to increment mapping
- compatibility promise text
- exceptions

Artifacts

Version scheme declarationProducer statement of the scheme, its precedence rules and its compatibility promise for a product line.

patch-upgrade-and-tag-types

Patch versus upgrade and tag types

CoSWID and NISTIR 8060 define four tag types used at different lifecycle points: corpus (pre-install media), primary (installed component), patch (incremental fix that MUST NOT change software-version) and supplemental (site-added metadata). Patch tags MUST link with rel=patches to the patched software. Upgrade replaces primary tags and changes version metadata. This distinction is a frequent omission in product catalogues that only store version strings.

Questions

Is the current identification record a corpus, primary, patch or supplemental tag, and where is it supposed to reside (media versus endpoint versus operator overlay)?state
Expected answer
- tag-type
If this is a patch, which release does it patch, and does the patch illegally change the software-version?relationship
Expected answer
- patches-release-ref
- patch-changes-version
If this is a pre-install corpus record, which installation media or package installer does it describe?process
Expected answer
- corpus-media-ref

Artifacts

SWID or CoSWID tagLifecycle-typed software identification tag for corpus, primary, patch or supplemental state.

distribution-and-integrityDistribution and Integrity2 findings

Where a release may legitimately be obtained, under what access conditions, and the cryptographic evidence that a fetched artifact is the released artifact.

distribution-channel-and-availability

Distribution Channel and Availability

Authoritative download locations and registries for a release, the access conditions attached to them, and how long prior releases stay retrievable.

Questions

From which authoritative download locations or registries is this release distributed?provenance
Expected answer
- download location
- registry reference
- mirror list
- authoritative flag
What access conditions apply to obtaining this release: public, entitled, embargoed or jurisdictionally restricted?access
Expected answer
- access condition code
- entitlement requirement
- jurisdiction restriction
How long are prior releases retained at the distribution point, and what is the removal policy?retention
Expected answer
- retention period
- removal trigger
- archival location after removal

Artifacts

Distribution point registrationRecord binding a release to each distribution location with its access conditions, authoritativeness and retention commitment.

artifact-integrity-and-signature

Artifact Integrity and Signature

Hashes, signatures and signing identities that let a consumer verify a fetched artifact, together with the verification outcome and any reproducibility claim.

Questions

Which hash algorithms and digest values are published for each distributable artifact of this release?evidence
Expected answer
- hash algorithm
- digest value
- artifact reference
- publishing party
Which signing identity signed the release, and how is that identity's authority established?security
Expected answer
- signing identity
- key or certificate reference
- trust anchor
- authority evidence
What verification procedure must a consumer run before accepting the artifact, and what does a failure trigger?validation
Expected answer
- verification steps
- required tooling
- failure handling rule
Is the build reproducible, such that an independent rebuild yields a bit-identical digest?quality
Expected answer
- reproducibility claim
- rebuild evidence
- known sources of nondeterminism

Artifacts

Integrity and signature recordThe bundle of digests, signatures and verification outcomes attached to a release's distributable artifacts.

composition-and-supply-chainComposition and Supply Chain2 layers

What the release is made of as declared in a bill of materials, how declared dependencies were resolved, and what provenance and development-practice evidence stands behind the build.

declared-compositionDeclared Composition3 findings

The bill of materials as a governed document about a release, and the dependency constraints and resolutions it records.

bill-of-materials-document

Bill of Materials Document

The SBOM treated as a dated, authored document about one release: its format and specification version, author, creation time, declared depth and explicitly declared known unknowns.

Questions

Who authored this bill of materials, and is that party the same as the software producer?provenance
Expected answer
- SBOM author reference
- producer reference
- generating tool name and version
- generation context
What depth does this bill of materials claim: top level only, direct dependencies, or complete transitive closure?measurement
Expected answer
- depth code
- component count
- closure completeness statement
Which parts of the composition are declared known unknowns rather than silently omitted?quality
Expected answer
- known unknown entries
- reason code
- expected resolution
Which bill-of-materials format and specification version does the document conform to, and was that conformance verified?interoperability
Expected answer
- format name
- specification version
- validation tool and result

Artifacts

Bill of materials documentThe machine-readable SBOM for a release, in whichever governed format the producer publishes, retained as an immutable versioned document.

dependency-graph-and-resolution

Dependency Graph and Resolution

Declared dependency constraints with scope and optionality, the concrete releases that satisfied them at build time, and the pinning that makes the resolution reproducible.

Questions

What constraint range and scope does the release declare for each dependency?composition
Expected answer
- constraint range expression
- dependency scope code
- optionality flag
Which concrete component release satisfied each constraint at build time, and which resolver produced that resolution?relationship
Expected answer
- resolved component reference
- resolver identity and version
- resolution time
How is a later re-resolution distinguished from the resolution recorded at build time?temporal
Expected answer
- build-time resolution set
- current resolution set
- drift delta
- observation times
Is the resolved dependency set pinned by a lockfile or digest so that the build can be reproduced?validation
Expected answer
- pinning mechanism
- lock digest
- reproduction evidence

Artifacts

Dependency resolution recordThe build-time snapshot binding each declared constraint to the concrete release that satisfied it, with resolver identity and lock digest.

composition-coverage-and-completeness

Coverage, completeness and known unknowns

CISA 2026 replaces NTIA Depth with Coverage (horizontal and vertical breadth) and requires explicitly identifying unknown information. CycloneDX compositions aggregate completeness as complete, incomplete, incomplete first-party only, incomplete third-party only or unknown. SPDX Sbom may carry multiple sbomTypes. An SBOM that omits unknowns is less operable than one that marks them. Completeness is a quality measurement of the composition evidence, not of the software.

Questions

What completeness aggregate applies to this composition, and is first-party or third-party content incomplete?measurement
Expected answer
- completeness-aggregate
- first-party-complete
- third-party-complete
Which component, dependency, license or identifier fields are explicitly unknown rather than omitted?evidence
Expected answer
- known-unknowns
What horizontal and vertical coverage does the producer claim relative to CISA 2026 Coverage, and what is out of that claim?constraint
Expected answer
- coverage-statement

Artifacts

Completeness declarationMachine-readable coverage and known-unknown statement for an SBOM or composition.

build-provenanceBuild Provenance and Development Assurance2 findings

Verifiable statements about what built the release from which inputs, and about the producer's secure development practices.

build-provenance-attestation

Build Provenance Attestation

Machine-verifiable provenance identifying the build platform and builder, the top-level inputs and source revision, the parameters used, and the build-integrity level the provenance supports.

Questions

Which build platform and builder identity produced this release?provenance
Expected answer
- builder identity
- build platform reference
- hosted or self-hosted flag
What top-level inputs, parameters and source revision entered the build?process
Expected answer
- source revision reference
- build parameters
- external input digests
What build-integrity level does the provenance support, and who verified that claim?evidence
Expected answer
- assurance level code
- verifying party
- verification time and result
How is the provenance protected from forgery by the tenant whose build it describes?security
Expected answer
- signing arrangement
- tenant isolation controls
- key custody description

Artifacts

Build provenance attestationSigned attestation describing the build of a specific artifact, bound to that artifact by digest.

development-practice-assurance

Secure Development Practice Assurance

Claims about the producer's secure development practices, the evidence for each claim, and whether the claim is self-attested, customer-audited or third-party assessed.

Questions

Which secure development framework practices does the producer claim, and over what organizational and product scope?requirement
Expected answer
- framework reference
- claimed practice identifiers
- scope statement
What evidence substantiates each claimed practice, and who attested to it?evidence
Expected answer
- evidence artifact reference
- attesting party
- attestation time
Is each claim self-attested, customer-audited or assessed by an independent third party?authority
Expected answer
- attestation type code
- assessor reference
- assessment validity window

Artifacts

Secure development attestationThe producer's statement of secure development practices with supporting evidence references and validity window.

rights-and-licensingRights and Licensing2 layers

The licence under which a release is offered, the obligations inherited from third-party components, and the restrictions on who may use, receive or re-export it.

license-identificationLicence Identification1 findings

What licence applies to a release, how it was determined, and who may change it.

license-declaration-and-expression

Licence Declaration and Expression

The licence expression applying to a release, distinguishing what the producer declared from what an analyst concluded, with the copyright holder and any licence change across releases.

Questions

What licence expression applies to this release as a whole, and in which expression syntax is it written?definition
Expected answer
- licence expression
- expression syntax and version
- scope of application
Where do the declared and the concluded licences differ, and on what evidence was the conclusion drawn?evidence
Expected answer
- declared expression
- concluded expression
- evidence reference
- concluding party
Who holds copyright in the product and who is empowered to relicense it?ownership
Expected answer
- copyright holder reference
- relicensing authority
- contributor agreement reference
Has the licence changed between releases, and does the change apply retroactively to prior releases?lifecycle
Expected answer
- change event time
- prior and new expression
- retroactivity statement

Artifacts

Licence declaration recordPer-release record of the licence expression, its determination basis, evidence and rights holder.

obligations-and-restrictionsObligations and Restrictions2 findings

What the product must ship or make available because of what it contains, and who may lawfully receive and use it.

third-party-attribution-obligations

Third-Party Attribution Obligations

Obligations inherited from bundled third-party components: attribution notices that must ship, reciprocal obligations and their reach, and corresponding-source availability duties with their duration.

Questions

Which attribution notices must ship with the product, and in what form must they be delivered?requirement
Expected answer
- notice text entries
- delivery form
- component references
Which contained components impose reciprocal obligations, and how far do those obligations reach into the product?constraint
Expected answer
- component references
- obligation class
- reach determination and rationale
Where is corresponding source made available for components that require it, and for how long must it stay available?retention
Expected answer
- source offer location
- availability period
- responsible party

Artifacts

Attribution notice setThe compiled set of notices and offers shipped with a release to satisfy inherited obligations.

use-and-export-restrictions

Use and Export Restrictions

Restrictions on who may obtain, run or re-export the product, including entitlement requirements, field-of-use exclusions, jurisdictional controls and documented waivers.

Questions

What entitlement is required to obtain and run this release lawfully?access
Expected answer
- entitlement type
- issuing party
- verification method
Which fields of use or deployment contexts are excluded by licence, contract or regulation?constraint
Expected answer
- excluded field of use
- source of the exclusion
- effective period
Which export-control or sanctions classifications apply to this release, and who determined them?authority
Expected answer
- classification code
- determining party
- jurisdiction
- determination time
Under what documented exception may a restriction be waived, and who approves the waiver?exception
Expected answer
- waiver scope
- approving authority
- waiver validity window
- conditions

Artifacts

Restriction registerRegister of entitlement requirements, field-of-use exclusions, export classifications and approved waivers for a product or release line.

deployment-and-operationDeployment and Operation2 layers

Where releases actually run: deployed instances, their hosting environments, the configuration in effect and the interfaces they expose or consume.

deployed-system-inventoryDeployed System Inventory2 findings

Concrete running installations and the environments that host them.

deployed-instance-record

Deployed Instance Record

One running installation of a specific release: its operator-side identifier, the version observed running, the window over which it ran, its purpose and its criticality.

Questions

Which identifier denotes this deployed instance in the operator's authoritative inventory?identity
Expected answer
- instance identifier
- issuing inventory system
- operator reference
Which release is actually running on this instance, as observed rather than as intended?state
Expected answer
- running release reference
- observation method
- observation time
- intended release reference
Over which time window did this instance run this release, with event time and observation time recorded separately?temporal
Expected answer
- go-live event time
- decommission or upgrade event time
- observation timestamps
What business criticality and exposure does this instance carry?measurement
Expected answer
- criticality level
- exposure rating
- assessing party
- assessment time

Artifacts

Deployment inventory entryOperator-owned record of one instance, its running release, observation evidence and criticality.

hosting-environment-and-platform

Hosting Environment and Platform

The environment class, platform stack, jurisdictional location and network exposure of the host on which instances run.

Questions

Which environment class does this host: development, test, staging, production or disaster recovery?classification
Expected answer
- environment class code
- classifying party
- promotion path
What platform, operating system and runtime constitute the hosting stack for this instance?composition
Expected answer
- platform descriptor
- operating system reference
- runtime reference
- container or image digest
In which jurisdiction and region does hosting occur, and does that location constrain what may be processed there?spatial
Expected answer
- region identifier
- jurisdiction
- processing constraints
Is this instance reachable from the public internet, and through which controlled boundary?security
Expected answer
- exposure code
- boundary control description
- last verification time

Artifacts

Environment profileDescription of a hosting environment: class, platform stack, location and exposure posture, referenced by the instances it hosts.

runtime-configuration-and-interfacesRuntime Configuration and Interfaces2 findings

What the deployed software is actually doing: effective configuration and drift, and the external services and data flows it touches.

effective-configuration-state

Effective Configuration State

The configuration actually in effect on an instance, its deviation from the released default or hardened baseline, and the change events that produced it. This matters because exploitability assessments are frequently conditional on configuration.

Questions

Which security-relevant configuration values are actually in effect on this instance, and when were they last observed?state
Expected answer
- configuration item values
- observation time
- collection method
How does the effective configuration differ from the release default or the hardened baseline?validation
Expected answer
- baseline reference
- deviation list
- risk annotation
Which change event last altered this configuration, and who authorised it?event
Expected answer
- change event time
- actor identity
- authorisation reference
- prior value

Artifacts

Configuration baseline snapshotPoint-in-time capture of the effective configuration of an instance against a named baseline.

external-interfaces-and-data-flows

External Interfaces and Data Flows

Services, endpoints and data flows a deployed instance exposes or consumes, including third-party services that are dependencies but never shipped as components.

Questions

Which external services does this instance call, and are they recorded as services rather than as shipped components?composition
Expected answer
- service reference
- provider reference
- criticality of the call path
What categories of data cross each interface, and is any of it personal or otherwise regulated?privacy
Expected answer
- data category codes
- regulated flag
- applicable regime reference
How is each interface authenticated and authorised, and where are its credentials held?access
Expected answer
- authentication mechanism
- authorisation model
- credential custody location

Artifacts

Interface and data-flow registerOperator-owned register of interfaces, service dependencies and data categories per instance or environment.

lifecycle-support-and-security-responseLifecycle, Support and Security Response2 layers

How long the product is maintained, how fixes are delivered, and how published vulnerabilities are mapped to versions, instances and exploitability judgements.

support-lifecycleSupport Lifecycle2 findings

Support status, end-of-life milestones and the mechanics by which fixes reach deployed instances.

support-status-and-end-of-life

Support Status and End of Life

The producer's binding statement about how long a product line or release receives fixes, the dated milestones that end that obligation, and what happens to instances that outlive it.

Questions

What support status applies to this release line today, and who set it?state
Expected answer
- support status code
- status effective time
- setting party
What are the announced end-of-support and end-of-life dates, and when were they announced?temporal
Expected answer
- end-of-support date
- end-of-life date
- announcement event time
- announcement reference
Does the declared support period satisfy the applicable regulatory minimum for the expected product lifetime?requirement
Expected answer
- regime reference
- required minimum period
- declared period
- gap assessment
What happens to deployed instances that remain in service after end of support, and who accepts the residual risk?exception
Expected answer
- continuation policy
- risk acceptance record
- extended support option

Artifacts

Product lifecycle statementThe producer's published statement of support status and end-of-life milestones for a product or release line.

update-and-patch-delivery

Update and Patch Delivery

How fixes reach deployed instances: channels, mechanism, default automation, separability of security fixes from feature change, and evidence that an update was actually applied.

Questions

By what mechanism are security updates delivered, and are they applied automatically by default?process
Expected answer
- update mechanism code
- default automation flag
- opt-out conditions
Are security fixes separable from feature changes so that an operator can apply one without the other?requirement
Expected answer
- separability statement
- security-only channel reference
- exceptions
What record proves that a given instance received and applied a given update?evidence
Expected answer
- update application record
- applying actor
- application time
- verification method

Artifacts

Update delivery recordRecord of an update's publication and of its application to specific instances.

vulnerability-and-advisoryVulnerability and Advisory3 findings

Published notices affecting the product and the product-specific judgement of whether a contained vulnerability is actually exploitable.

advisory-and-exposure-mapping

Advisory and Exposure Mapping

Notices of defects or vulnerabilities and the mapping from each notice to affected version ranges, contained components and deployed instances, with severity and any authority-reporting duty.

Questions

Which advisory and vulnerability identifiers apply, who published them, and at which tracking version?provenance
Expected answer
- advisory identifier
- vulnerability identifier
- publisher reference
- tracking version and current release time
Which version ranges of this product are declared affected, fixed, or under investigation?relationship
Expected answer
- affected version ranges
- fixed version references
- range expression syntax
What severity or exploitability scores are asserted, by which scoring system and which scoring party?measurement
Expected answer
- score value and vector
- scoring system version
- scoring party
- score time
When must an actively exploited vulnerability in this product be reported, and to which authority?requirement
Expected answer
- reporting trigger
- reporting deadline
- recipient authority
- submission evidence

Artifacts

Security advisory documentMachine-readable advisory identifying affected products, remediations, scores and threats.

exploitability-assessment

Exploitability Assessment

The product-specific determination of whether a vulnerability present in a contained component is actually exploitable in this product or deployment, with a recognised justification and its conditions.

Questions

What is this product's status for the vulnerability: affected, not affected, fixed, or under investigation?state
Expected answer
- status code
- status setting party
- status time
If the product is not affected, which recognised justification applies and what evidence supports it?evidence
Expected answer
- justification code
- supporting evidence reference
- analysing party
Does the assessment hold for all deployments, or only under stated configuration or environment conditions?constraint
Expected answer
- applicability conditions
- configuration references
- environment class scope
What triggers re-assessment, and how is a superseded assessment retained?lifecycle
Expected answer
- re-assessment trigger
- superseding statement reference
- retention rule for prior statements

Artifacts

Exploitability exchange statementPublished statement of product status and justification for a specific vulnerability, consumable alongside the SBOM.

remediation-and-fix-access

Remediation, entitlements and restart

CSAF remediations carry category, date, details, product or group ids, URL, restart-required and entitlements. Entitlements here are access gates on a remediation (who may obtain the fix), not the intellectual-property license of the software. CoSWID activation-status and entitlement-key similarly record install-time activation without storing unprotected license secrets. Restart-required is an operational constraint on deployed systems.

Questions

What remediation category and URL are offered for the affected products, and on which date was that remediation published?process
Expected answer
- remediation-category
- remediation-url
Does applying the remediation require a restart, and of what kind?constraint
Expected answer
- restart-required
Which entitlements gate access to the fix, and what activation status applies to the installed product?access
Expected answer
- remediation-entitlements
- activation-status

Artifacts

Remediation recordFix, workaround or mitigation bound to products, with entitlement and restart constraints.

quality-conformance-and-regulatoryQuality, Conformance and Regulatory2 layers

What quality the product is specified and measured against, what verification evidence exists, and what regulatory documentation must be produced and retained to place it on a market.

quality-and-verificationQuality and Verification2 findings

Specified quality characteristics with their measures, and the evidence that a release was verified against them.

quality-characteristics-and-measures

Quality Characteristics and Measures

The quality characteristics selected for this product from a governed quality model, the measure and target defined for each, and the values actually measured on a named release.

Questions

Which quality model and which of its characteristics are used to specify this product's quality requirements?classification
Expected answer
- quality model reference and version
- selected characteristics and subcharacteristics
- selection rationale
What measure, measurement method and target value are defined for each selected characteristic?measurement
Expected answer
- measure definition
- measurement method
- target value and unit
What values were actually measured, on which release, and under which stated conditions?quality
Expected answer
- measured value
- release reference
- measurement conditions
- measurement time

Artifacts

Quality measurement reportReport of measures, targets and measured values for a release against the declared quality model.

verification-and-test-evidence

Verification and Test Evidence

Evidence that a release was verified: which activities were performed, how each result binds to the exact artifact digest tested, and which defects were knowingly accepted at release.

Questions

Which verification activities were performed against this release, and by whom?process
Expected answer
- activity type
- performing party
- activity time
- scope covered
How is each verification result bound to the exact artifact digest it was run against?validation
Expected answer
- subject artifact digest
- binding method
- result reference
Which known defects were accepted as open at release, and who accepted the residual risk?decision
Expected answer
- defect references
- acceptance rationale
- accepting party
- acceptance time

Artifacts

Verification evidence packageThe collected verification results for a release, each bound to the artifact digest it describes.

regulatory-conformityRegulatory Conformity1 findings

Which market regimes apply, which conformity route was taken, and what documentation must exist and be retained.

conformity-and-technical-documentation

Conformity Assessment and Technical Documentation

The regulatory regimes in scope for placing the product on each target market, the conformity assessment route used, the declaration or marking issued, and the technical documentation with its retention duty.

Questions

Which product-regulation regimes apply to this product in each target market, and from which date?requirement
Expected answer
- regime reference
- market or jurisdiction
- applicability date
- applicability determination party
Which conformity assessment route was used, and who performed the assessment?authority
Expected answer
- route code
- assessing body reference
- assessment outcome and date
What technical documentation must exist, and for how long must it be retained after the product is placed on the market?retention
Expected answer
- documentation inventory
- retention period
- custodian
- storage location
What declaration of conformity or marking is issued, and against exactly which release does it hold?evidence
Expected answer
- declaration reference
- marking applied
- covered release references
- signatory

Artifacts

Technical documentation fileThe dossier a manufacturer must be able to produce for market surveillance, assembled from identity, composition, provenance, verification and lifecycle findings.

Publication holds

Source and live-version verification for every accepted source before publication: the providers disagree on SPDX 3.0.1 publisher attribution (Linux Foundation alone versus Linux Foundation with OMG), on the CycloneDX pin (1.6 with ECMA-424 June 2024 versus 1.7 with ECMA-424 December 2025), and on the ECMA-427 PURL edition; SLSA v1.1 is recorded as retired in favour of v1.2. Each URL must be re-fetched and each pin restated before any alignment claim is published.
Field-level verification of the 2026 CISA minimum elements against the source PDF tables. The providers give divergent readings of the same document: the base speaks of declared depth and adds component hash and licence, while the source provider claims Depth is replaced by Coverage and Supplier Name by Component Producer, and itself admits the PDF body was not fully field-extracted. No element name from this document may be bound in the published draft until the tables are read directly.
Multi-domain profile validation across at least five delivery profiles before the coverage claim stands: commercial on-premises application, open-source library in a package ecosystem, container image, firmware-as-software, and SaaS-only offering with no distributable artifact. The base states that release and integrity findings degrade for the SaaS case; that degradation must be exercised rather than asserted.
Clause-level confirmation of ISO/IEC 19770-2:2015 and NISTIR 8060 for the accepted tag-type finding, since the source provider states the 19770-2 XML schema annexes were not retrieved in full and the tag information model was carried via RFC 9393 and paraphrase.
Paywalled-standard limitation must be restated at publication: alignment to ISO/IEC/IEEE 12207:2026 and ISO/IEC 25010:2023 rests on catalogue-level scope statements, not clause-level reading, and no conformance to SPDX, CycloneDX, CSAF, ISO 19770-2 or 12207 is claimed.

Deferred research

SBOM type taxonomy (design, source, build, analyzed, deployed, runtime) plus tool name and version and generation context, to be absorbed as elements of the existing bill-of-materials-document finding rather than a parallel finding, once the CISA element names are verified against the PDF tables.
Advisory TLP labelling, sharing constraints, CSAF document status lifecycle (draft, interim, final, withdrawn) and profile selection, as element enrichment of advisory-and-exposure-mapping and of the model's access policy rather than as a separate advisory-identity finding.
Endpoint discovery evidence: CoSWID payload versus on-device evidence mutual exclusivity, and comparison of observed endpoint file or image hashes against the published release digest set, as element enrichment of deployed-instance-record.
Accessibility conformance, which the base names as a live structural gap with no authoritative source consulted; treating it as a quality subcharacteristic is probably insufficient for products subject to accessibility legislation.
Cryptographic bill of materials and cryptographic asset inventory for post-quantum migration planning, currently reachable only through a component-type reference.
AI-specific and SaaS-specific extra transparency elements, including the separately published CISA AI SBOM minimum elements, which both providers flag as required extras but neither expands.
CoSWID entity role vocabulary (aggregator, distributor, licensor, maintainer) with reg-id naming authority, as elements on producer-and-stewardship so role assertions can be correlated across documents.
SPDX 3.1 release-candidate expansion into hardware, safety and operations, tracked as emerging and deliberately excluded from the canonical structure until it is formally published.
Product-line variability beyond edition and channel (feature flags, software product lines) and per-jurisdiction export-control classification schemes, neither of which has primary support in either provider run.