Finding BOM v1 Schema

Validates one L2 Finding BOM version. Shape-only: provenanceRef resolution, author-identity equality with the provenance attestation, the disclosability condition, and supersession chains are verifier (adbom-cli) checks. Normative requirements: https://sec.hypermedia.au/standards/finding/v1

Validates the finding standard.Raw schema (JSON).

Field	Type	Required	Constraints
bomFormat	string	yes	one of: CycloneDX
specVersion	string	yes	= 1.7
externalReferences FND-004: the analysis-provenance attestation, by document-form BOM-Link with its paired hash	array	yes	items 1–∞
serialNumber	string	yes	pattern ^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
version	integer	yes	—
metadata	object	yes	—
components FND-003: exactly one data component — the finding document with at least one approved-floor hash (SHA-384 or SHA-512)	array	yes	items 1–1
signature	ref	yes	—

Also defines: propertyEntryhashEntrysignature