{
      "name": "cra-product-conformance",
      "domain": "DORA / NIS2 / ICT Resilience",
      "title": "CRA Product Conformance (EU CRA Annex I + Art. 14)",
      "description": "Validate an SPDX SBOM against EU CRA Annex I machine-readable requirement (art-138) → check Annex I essential requirements: sbom_machine_readable, top-level dep coverage, vuln handling policy, secure-by-default, conformity route (art-139) → assess CRA Article 14 vulnerability reporting readiness: 24-hour early warning, 72-hour notification, CSIRT/ENISA endpoint (art-140). Obligation date Art.14: 11 Sep 2026. Full CRA product conformance pipeline. Zero network.",
      "composer_url": "https://ainumbers.co/chaingraph/chains/cra-product-conformance.html",
      "steps": [
        {
          "tool_id": "art-138-spdx-sbom-validator",
          "handoff": "SPDX SBOM validity feeds Annex I completeness checker"
        },
        {
          "tool_id": "art-139-cra-annex1-completeness-checker",
          "handoff": "Annex I gaps and conformity route feed vulnerability reporting readiness"
        },
        {
          "tool_id": "art-140-cra-vuln-reporting-readiness",
          "handoff": "Article 14 readiness emits full CRA product conformance verdict — final stage"
        }
      ]
    }