AI-BOM / SBOM Card

1 · Why this document exists

Every regulated AI deployment reaches a point where a buyer's CISO, their EU CRA conformity assessor, the EU AI Office, US FedRAMP, or the UK NCSC asks the same six questions:

1. "What is inside your model?" (weights, architecture, training data, tokenisers, RLHF preferences)
2. "Where did every component come from?" (provenance, supply chain, integrity)
3. "What is its licence posture?" (commercial / OSS / copyleft / proprietary)
4. "What known vulnerabilities does it have?" (CVEs, advisories, patch status)
5. "Can you prove it hasn't been tampered with?" (cryptographic attestation, reproducible builds)
6. "Will you tell us when something changes?" (continuous monitoring, advisory feed)

This card answers all six in one place, with machine-readable artefacts for automated ingestion and human-readable summary for procurement / legal / CISO review.

2 · The 3 BOM formats (machine-readable)

All three are regenerated every build. Every artefact is SHA-256 hashed and Ed25519-signed by the build pipeline's SIGIL key. The build pipeline runs in a hermetic, network-isolated environment with reproducible-build guarantees (SLSA L3 source).

3 · The BOM hierarchy (what gets inventoried)

DEFONEOS's BOM has 4 layers. Every component at every layer is inventoried, attested, and SIGIL-signed.

The full transitive inventory at L1 alone is ~3,200 direct dependencies and ~28,000 transitive. Of those, ~450 are ML-specific (model checkpoints, tokenisers, RLHF preference sets, evaluation harness components).

4 · CycloneDX 1.6 sample (excerpt)

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:defoneos-2026-07-14-v0.95.1",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-14T00:00:00Z",
    "tools": {
      "components": [{"type": "application", "name": "defoneos-bom-builder", "version": "1.4.2"}]
    },
    "authors": [{"name": "DEFONEOS Sovereign Build", "email": "build@csoai.org"}],
    "component": {
      "bom-ref": "defoneos-runtime@v0.95.1",
      "type": "application",
      "name": "DEFONEOS Sovereign Runtime",
      "version": "v0.95.1",
      "licenses": [{"license": {"id": "Apache-2.0"}}],
      "hashes": [
        {"alg": "SHA-256", "content": "abc123..."},
        {"alg": "ED25519", "content": "a4f8c2d9e1b3..."}
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pkg:pypi/torch@2.3.1",
      "type": "library",
      "name": "torch",
      "version": "2.3.1",
      "licenses": [{"license": {"id": "BSD-3-Clause"}}],
      "hashes": [{"alg": "SHA-256", "content": "..."}],
      "purl": "pkg:pypi/torch@2.3.1",
      "externalReferences": [
        {"type": "website", "url": "https://pytorch.org"},
        {"type": "vcs", "url": "https://github.com/pytorch/pytorch"}
      ]
    },
    {
      "bom-ref": "model:sov3-small@9b",
      "type": "machine-learning-model",
      "name": "sov3-small",
      "version": "9b",
      "licenses": [{"license": {"name": "DEFONEOS-Sovereign-License-1.0"}}],
      "hashes": [{"alg": "SHA-256", "content": "..."}]
    }
  ]
}

5 · The 6 regulatory regimes cross-walked

6 · Model Card · Data Card · System Card

Beyond the BOM, DEFONEOS publishes three narrative cards per model version:

The System Card is also filed with UK AISI per UK AI Safety Institute evaluation protocol. DEFONEOS is a UK AISI Voluntary Commitment signatory (filed 2026-06).

7 · Vulnerability & advisory pipeline

1. Daily OSV / Trivy / Grype / Snyk scan of all 4 BOM layers
2. Matching against CVE / GHSA / OSV databases
3. Triage by 33-agent BFT council: severity assigned within 4 hours (CRITICAL / HIGH / MEDIUM / LOW)
4. Patch SLA: CRITICAL = 24h · HIGH = 7d · MEDIUM = 30d · LOW = next release
5. Patched build attested, SIGIL-anchored, advisory published to csoai.org/advisories
6. Buyer notification via tenant webhook + email + SIGIL channel within 1h of advisory publication

8 · Licence posture (named)

No GPL / AGPL / SSPL contamination in the core stack. Verified by daily ScanCode scan + weekly FOSSology deep scan. Any new dependency with copyleft licence is blocked at PR review.

9 · Cryptographic attestation (the trust root)

Every build produces a SIGIL-anchored attestation. The signing chain:

1. Source code is committed to a 2-party-review Git repository (SLSA L3 source).
2. Build pipeline runs in a hermetic environment (no network access); reproducible from source.
3. Output artefacts (binaries, model weights, BOMs) are hashed (SHA-256).
4. Hashes are signed with the build pipeline's Ed25519 SIGIL key (HSM-backed).
5. Signature is committed to the 33-agent BFT council ledger.
6. Public verification endpoint: csoai.org/aibom/{build_sha256}.sig

Buyers verify any artefact in <100ms: curl https://csoai.org/aibom/verify/{build_sha256} returns the build details + signature status.

10 · Cross-walk to other DEFONEOS artefacts

11 · The 5 Anti-Patterns (BOM Disasters We Refuse)

1. No "we'll generate the SBOM at audit time." BOMs are generated every build, daily scan, and advisory release.
2. No "vendor gave us a binary with no source." All 3rd-party components are inventoried + verified.
3. No "we patch quarterly." CRITICAL CVEs patched within 24h; buyer notified within 1h.
4. No "licence is the legal team's problem." Licence scanning is automated; copyleft blocks PR merge.
5. No "the model is a black box." Model Card + Data Card + System Card are public per release.

12 · Buyer Next Steps

1. Verify this document hash: curl https://csoai.org/defoneos-mod-ai-bom-sbom-card.html | shasum -a 256
2. Browse a sample BOM: csoai.org/aibom/sample.cdx.json
3. Verify any build attestation: csoai.org/aibom/verify/{build_sha256}
4. Subscribe to advisory feed: csoai.org/advisories/subscribe
5. Request a 60-minute BOM walkthrough with our CISO.
6. Inspect the System Card: csoai.org/system/sovereign-runtime/card.md