{
      "tool_id": "art-138-spdx-sbom-validator",
      "tool_version": "1.0.0",
      "display_name": "SPDX SBOM Validator (EU CRA Annex I)",
      "mcp_name": "validate_spdx_sbom",
      "mandate_type": "compliance_mandate",
      "wave": 25,
      "gpu": false,
      "url": "https://ainumbers.co/chaingraph/art-138-spdx-sbom-validator.html",
      "description": "Validates an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: spdxVersion matches SPDX-2.x or SPDX-3.x, SPDXID present, all packages carry name+versionInfo+downloadLocation (or purl externalRef), relationships array non-empty. Emits sbom_valid verdict and per-package gap list. Root stage of cra-product-conformance chain.",
      "input_schema_ref": "chaingraph/art-138-spdx-sbom-validator.html#manifest",
      "consumes": [],
      "feeds": [
        "art-139-cra-annex1-completeness-checker"
      ],
      "status": "live",
      "conformance_fixtures": true,
      "compute_capability": "server",
      "compute_images": [{"system":"sha256-source","image_id":"sha256:72aba0699f8a03e3cc099b887c437ef7f1a801c5284b6e00d616419870a71ef6","valid_from":"2026-07-10"},{"system":"risc0","image_id":"sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6","valid_from":"2026-06-28"}],
      "compute_proof": {
        "type": "ZkVmReceipt",
        "system": "risc0",
        "receiptFormat": "groth16-bn254",
        "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
        "seal": "JoT+Fyi/8kpTraZpkE6R9sG132/laD0lAmTitZDAXLswM3VST+PV7T18d1xvug+NG2e+NXstiN/m7XJxuPPiGi6YrdEMFeIXKm5MeZfHyE6NXGM+TZuJs3JzTG0v0U/fD/yllWEymD/gxCP2dIHkTur1lR/X27szMzTXXc/dSNQGJwu4Ow4b9jMV1Td2H7ultwQeTWmxzf1s15ru1tWM4yOSYM0PSKKD9Y9+5TJZ9PTIjbV7NjQGrAW2TfoirbNlL+12t3sK0KXS8o6TphQr2QaNB/0X1YMoigJlUu8iVmEwORRf0GlaaeaLzMMsQZFtopzRfRZZUArKTa0wqrA5nw==",
        "journal": {
          "chaingraph_version": "0.4.0",
          "kernel_digest": "sha256:18c614b3a041c909a5b08d50674dbc1b0969d0fa0a9e3fa43bdea58ac7e1bf92",
          "output": {
            "format": "SPDX",
            "has_relationships": true,
            "package_count": 1,
            "packages_missing_version": [],
            "sbom_valid": true,
            "spdx_version": "SPDX-2.3"
          }
        }
      },
      "export_capability": [
        "json",
        "vc"
      ]
    }