{
      "name": "sbom-provenance-attestation",
      "domain": "DORA / NIS2 / ICT Resilience",
      "title": "SBOM Provenance Attestation (EU CRA / SLSA / OpenVEX)",
      "description": "Validate a CycloneDX SBOM against EU CRA Annex I machine-readable SBOM requirement (art-135) → verify the SLSA provenance in-toto statement: subject digest match, builder.id present, claimed build level (art-136) → validate the OpenVEX vulnerability disclosure statement including not_affected justification (art-137). Full EU CRA supply-chain attestation pipeline. Zero network.",
      "composer_url": "https://ainumbers.co/chaingraph/chains/sbom-provenance-attestation.html",
      "steps": [
        {
          "tool_id": "art-135-cyclonedx-sbom-validator",
          "handoff": "SBOM validity verdict feeds SLSA provenance verifier"
        },
        {
          "tool_id": "art-136-slsa-provenance-verifier",
          "handoff": "Provenance validity feeds OpenVEX disclosure validator"
        },
        {
          "tool_id": "art-137-openvex-statement-validator",
          "handoff": "VEX validity emits full supply-chain attestation verdict — final stage"
        }
      ]
    }