{
  "tool_id": "art-386-lint-cbom-structure",
  "tool_version": "1.0.0",
  "display_name": "CBOM Structural Lint & CNSA-2.0 Classifier",
  "mcp_name": "lint_cbom_structure",
  "mandate_type": "compliance_mandate",
  "wave": 65,
  "gpu": false,
  "url": "https://ainumbers.co/chaingraph/art-386-lint-cbom-structure.html",
  "description": "Validates a pasted CycloneDX 1.6 Cryptography Bill of Materials against a hand-derived field subset (algorithm, key size, certification level, crypto functions) and classifies declared algorithm assets as quantum-vulnerable (RSA, ECDSA/ECDH, DH, SHA-1) or CNSA-2.0 target-aligned (ML-KEM-1024, ML-DSA-87, AES-256, SHA-384/512). Structural and classification checks only; every finding asserted from the pasted CBOM. Not a scanner, not discovery, not a cryptographic audit.",
  "input_schema_ref": "chaingraph/art-386-lint-cbom-structure.html#manifest",
  "deadline": null,
  "consumes": [],
  "feeds": [],
  "status": "live",
  "conformance_fixtures": true,
  "compute_capability": "server",
  "compute_images": [{"system":"sha256-source","image_id":"sha256:d82c9dafda429dc646d851ed45d680724fa9e2d9c308b29e2d9a6ac10f24c257","valid_from":"2026-07-10"},{"system":"risc0","image_id":"sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6","valid_from":"2026-07-10"}],
  "compute_proof_ready": "ready",
  "compute_proof": {
    "type": "ZkVmReceipt",
    "system": "risc0",
    "receiptFormat": "groth16-bn254",
    "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
    "seal": "LWO3GiJh1la9l79u7LDmPlhpYvYvj8V7wWNVKDgx/xAVStinFm8+kCVwVgxj7hKWBAD5YXs/Q4jhSeOiloyHxx1bZSLUg3UI3uW74yS2QprTOvbtTkTWzQZdYxmY/wAfK3EO3YSesxs/zm5CAMlIyw2bBuX5vxMbsU52oduq+v8sTnvQbX/UC0oKs1HufTabuImkrllFRrrdC7I41wtW4g+MPkp/DJLLq1cauh40gSiVmFyXzPV+w2swDukFDOQJAUeeq8uTNJPHvj5x7hfoC2dU5SFwEACzXZZxJieoahsWWn8sfdNLegBlqsCefwqIMbqC9zVb/hiT1igcHifCEA==",
    "journal": {
      "chaingraph_version": "0.4.0",
      "kernel_digest": "sha256:d82c9dafda429dc646d851ed45d680724fa9e2d9c308b29e2d9a6ac10f24c257",
      "output": {
        "cbom_structurally_valid": false,
        "cnsa2_ready_count": 1,
        "compliance_flags": [
          "STRUCTURAL_LINT_ONLY_NOT_A_SCANNER",
          "CBOM_STRUCTURAL_ISSUES_FOUND",
          "QUANTUM_VULNERABLE_PRIMITIVES_ASSERTED"
        ],
        "data_version": "cnsa2-targets-2026-07-18",
        "findings": [
          {
            "classification": "asserted:quantum_vulnerable",
            "index": 0,
            "matched_pattern": "RSA",
            "name": "RSA-2048",
            "parameter_set_identifier": "2048",
            "primitive": "signature",
            "status": "STRUCTURAL_VALID"
          },
          {
            "classification": "asserted:cnsa2_ready",
            "index": 1,
            "matched_pattern": "ML-KEM-1024",
            "name": "ML-KEM-1024",
            "parameter_set_identifier": "ML-KEM-1024",
            "primitive": "key-encapsulation",
            "status": "STRUCTURAL_VALID"
          },
          {
            "classification": "asserted:quantum_vulnerable",
            "index": 2,
            "matched_pattern": "SHA-1",
            "name": "SHA-1",
            "parameter_set_identifier": "SHA-1",
            "primitive": "hash",
            "status": "STRUCTURAL_VALID"
          },
          {
            "classification": "asserted:unclassified",
            "index": 3,
            "missing_fields": [
              "cryptoProperties.algorithmProperties.certificationLevel"
            ],
            "name": "AES-256-GCM",
            "status": "STRUCTURAL_INVALID"
          }
        ],
        "structural_issues": [],
        "structurally_invalid_count": 1,
        "total_algorithm_assets": 4,
        "total_components": 4,
        "unclassified_count": 0,
        "verdict": "INVALID_CBOM",
        "vulnerable_count": 2
      }
    }
  },
  "export_capability": [
    "json",
    "csv",
    "pdf"
  ]
}