{
  "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:98e7708a-f2ec-403f-86dc-fbbffd8fb9ed",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-10T00:00:00Z",
    "authors": [
      {
        "name": "Hypermedia Au Security Team"
      }
    ],
    "component": {
      "type": "data",
      "name": "Artifact Entry Specification",
      "version": "1.0.0"
    },
    "properties": [
      {
        "name": "cyberbench:layer",
        "value": "L0"
      },
      {
        "name": "cyberbench:fullname",
        "value": "Artifact Entry (evidence / derived artifact, hash-only)"
      }
    ]
  },
  "definitions": {
    "standards": [
      {
        "bom-ref": "artifact-entry-v1.0.0",
        "name": "Hypermedia Security: Artifact Entry Specification",
        "version": "1.0.0",
        "description": "The L0 artifact entry: the hash-only record of one piece of evidence (an original file, stored exactly as received and never changed) or one derived artifact (produced from evidence by processing) inside a CyberBench case. An artifact entry is not a document of its own — it is a CycloneDX component that lives inside the Case Provenance BOM (case-provenance/v1) as one element of its components array. It carries no signature: its integrity comes from the seal over the enclosing catalog, and each seal is independently time-anchored by an RFC 3161 token (timestamp-token/v1).",
        "owner": "Hypermedia Au",
        "externalReferences": [
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/schemas/artifact-entry/v1.schema.json",
            "comment": "The BOM schema documents conforming to this standard validate against.",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "schema-url"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/case-provenance/v1",
            "comment": "The standard whose documents enclose entries governed by this one.",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "enclosing-standard"
              }
            ]
          },
          {
            "type": "documentation",
            "url": "https://ecma-international.org/publications-and-standards/standards/ecma-424/",
            "comment": "ECMA-424 2nd edition (December 2025) — the CycloneDX 1.7 BOM specification"
          },
          {
            "type": "documentation",
            "url": "https://cyclonedx.org/docs/1.7/json/",
            "comment": "CycloneDX 1.7 JSON reference — component type enumeration (includes file, data, machine-learning-model), hash algorithm enumeration, bom-ref rules, name/value properties"
          },
          {
            "type": "documentation",
            "url": "https://github.com/CycloneDX/cyclonedx-property-taxonomy",
            "comment": "CycloneDX property taxonomy — namespaced property naming; the cyberbench: namespace follows it"
          },
          {
            "type": "documentation",
            "url": "https://www.iso.org/standard/44381.html",
            "comment": "ISO/IEC 27037:2012 — Guidelines for identification, collection, acquisition and preservation of digital evidence"
          },
          {
            "type": "documentation",
            "url": "https://www.iso.org/standard/44406.html",
            "comment": "ISO/IEC 27042:2015 — Guidelines for the analysis and interpretation of digital evidence (continuity, validity, reproducibility, repeatability)"
          },
          {
            "type": "documentation",
            "url": "https://www.w3.org/TR/prov-dm/",
            "comment": "W3C PROV-DM — wasDerivedFrom: a derivation is a transformation of one entity into another"
          },
          {
            "type": "documentation",
            "url": "https://www.law.cornell.edu/rules/fre/rule_901",
            "comment": "US FRE 901(b)(9) — authentication via evidence describing a process or system and showing it produces an accurate result"
          },
          {
            "type": "documentation",
            "url": "https://www.rfc-editor.org/rfc/rfc2119",
            "comment": "RFC 2119 (as clarified by RFC 8174) — requirement key words; only capitalised forms are normative"
          },
          {
            "type": "website",
            "url": "https://sec.hypermedia.au"
          }
        ],
        "requirements": [
          {
            "bom-ref": "cyclonedx-component-conformance",
            "identifier": "ART-001",
            "title": "CycloneDX Component Conformance",
            "text": "An artifact entry MUST be a CycloneDX 1.7 component object. Its type MUST be 'file' for raw evidence or 'data' for a derived artifact; 'machine-learning-model' MAY be used where the artifact is itself a model. All three values are members of the CycloneDX 1.7 component type enumeration.",
            "descriptions": [
              "Using plain CycloneDX components keeps every artifact entry readable by standard BOM tooling. The entry is enumerated inside the Case Provenance BOM's components array; it is never a standalone document."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#cyclonedx-component-conformance"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "allowed-types",
                "value": "file,data,machine-learning-model"
              }
            ]
          },
          {
            "bom-ref": "bom-ref-convention",
            "identifier": "ART-002",
            "title": "BOM Reference Convention",
            "text": "An artifact entry MUST carry a bom-ref that is unique within the enclosing BOM. The bom-ref MUST follow the slug convention 'evidence-<ordinal>-<hashPrefix>' for evidence or 'derived-<sourceOrdinal>-<kind>' for derived artifacts, and MUST NOT begin with 'urn:cdx:' (reserved by CycloneDX for BOM-Links).",
            "descriptions": [
              "The bom-ref is the anchor that BOM-Links from other objects resolve to — custody events reference it, and a finding's analysis-provenance inputRefs bind to it. Every such cross-reference pairs the link with the target's content hash: the link locates, the hash proves."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#bom-ref-convention"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "evidence-slug",
                "value": "evidence-<ordinal>-<hashPrefix>"
              },
              {
                "name": "derived-slug",
                "value": "derived-<sourceOrdinal>-<kind>"
              }
            ]
          },
          {
            "bom-ref": "hash-binding",
            "identifier": "ART-003",
            "title": "Hash Binding",
            "text": "An artifact entry MUST contain at least one hash entry with alg 'SHA-256' and lowercase hexadecimal content. Entries for stronger algorithms (SHA-512, SHA3-256, SHA3-512, BLAKE3) MAY be added; all values MUST be members of the CycloneDX hash algorithm enumeration.",
            "descriptions": [
              "For evidence this hash is the artifact's identity; for derived artifacts it is the integrity anchor of the persisted file. Only hashes enter the BOM — evidence bytes stay in the Vault and never leave the machine. This serves ISO/IEC 27037 integrity and preservation."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#hash-binding"
              },
              {
                "name": "validation-method",
                "value": "cryptographic-hash"
              },
              {
                "name": "required-algorithms",
                "value": "SHA-256"
              },
              {
                "name": "optional-algorithms",
                "value": "SHA-512,SHA3-256,SHA3-512,BLAKE3"
              }
            ]
          },
          {
            "bom-ref": "artifact-class",
            "identifier": "ART-004",
            "title": "Artifact Class Declaration",
            "text": "An artifact entry MUST declare exactly one cyberbench:artifactClass property with value 'evidence' or 'derived'. This is a closed set: no other values are valid in v1.",
            "descriptions": [
              "The class is the discriminator every other requirement in this standard conditions on. Evidence is an original file brought into the case; derived is something produced from evidence by processing. Domain properties use the cyberbench: namespace per the CycloneDX property taxonomy convention."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#artifact-class"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "allowed-values",
                "value": "evidence,derived"
              },
              {
                "name": "vocabulary",
                "value": "closed"
              }
            ]
          },
          {
            "bom-ref": "evidence-identity",
            "identifier": "ART-005",
            "title": "Evidence Identity",
            "text": "An evidence entry MUST carry a cyberbench:evidenceId property whose value is the SHA-256 of the original bytes, equal to the SHA-256 entry in the component's hashes array. This value is the Evidence.id — the identity every later object traces back to.",
            "descriptions": [
              "The SHA-256 of the bytes as received is the only guaranteed representation of the original in the whole system. Serves ISO/IEC 27037 identification."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#evidence-identity"
              },
              {
                "name": "validation-method",
                "value": "cryptographic-hash"
              },
              {
                "name": "applies-to-class",
                "value": "evidence"
              }
            ]
          },
          {
            "bom-ref": "evidence-ordinal",
            "identifier": "ART-006",
            "title": "Evidence Ordinal",
            "text": "An evidence entry MUST carry a cyberbench:ordinal property: a positive integer recording append-only ingest order within the case.",
            "descriptions": [
              "The ordinal makes the ingest sequence explicit and gap-checkable, complementing the custody chain's strictly monotonic event sequence."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#evidence-ordinal"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "applies-to-class",
                "value": "evidence"
              }
            ]
          },
          {
            "bom-ref": "evidence-immutability",
            "identifier": "ART-007",
            "title": "Evidence Immutability",
            "text": "An evidence entry MUST carry a cyberbench:immutable property with value 'true'. The original bytes MUST never be modified; all processing MUST produce new, separately hashed derived artifacts.",
            "descriptions": [
              "This is the ISO/IEC 27037 preservation posture stated on the record: originals are frozen at the door, and everything else in the case derives from them without touching them."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#evidence-immutability"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "applies-to-class",
                "value": "evidence"
              }
            ]
          },
          {
            "bom-ref": "derived-lineage",
            "identifier": "ART-008",
            "title": "Derived Lineage",
            "text": "A derived entry MUST carry cyberbench:sourceEvidenceRef (the bom-ref of the evidence entry it was produced from) AND cyberbench:sourceEvidenceHash (the SHA-256 of that source evidence). Neither is valid without the other. The enclosing Case Provenance BOM SHOULD mirror this edge in its dependencies array.",
            "descriptions": [
              "This is the lineage edge — the CycloneDX expression of a W3C PROV derivation (wasDerivedFrom: the transformation of one entity into another). The paired hash makes the reference provable, not just locatable."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#derived-lineage"
              },
              {
                "name": "validation-method",
                "value": "cross-reference"
              },
              {
                "name": "applies-to-class",
                "value": "derived"
              },
              {
                "name": "paired-fields",
                "value": "cyberbench:sourceEvidenceRef,cyberbench:sourceEvidenceHash"
              }
            ]
          },
          {
            "bom-ref": "derived-nonreproducibility",
            "identifier": "ART-009",
            "title": "Non-Reproducibility Disclosure",
            "text": "A derived entry MUST carry cyberbench:reproducible with value 'false' and cyberbench:integrity with value 'hash-at-rest'. The hash protects the persisted file and MUST NOT be treated as a re-derivation target.",
            "descriptions": [
              "The honest disclosure: ML-produced artifacts are method-repeatable, not byte-repeatable. Trust comes from the hash of the file as persisted plus the record of how it was made — never from re-making it. This serves the documented-process expectation of ISO/IEC 27042 and the process-or-system authentication route of US FRE 901(b)(9); a claim of byte-identical reproduction is never made."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#derived-nonreproducibility"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "applies-to-class",
                "value": "derived"
              },
              {
                "name": "required-values",
                "value": "cyberbench:reproducible=false,cyberbench:integrity=hash-at-rest"
              }
            ]
          },
          {
            "bom-ref": "no-individual-signature",
            "identifier": "ART-010",
            "title": "No Individual Signature",
            "text": "An artifact entry MUST NOT carry a signature of its own and MUST NOT embed artifact content. Its integrity is bound by the seal over the enclosing Case Provenance BOM; each seal is time-anchored by an external RFC 3161 token. Verifiers MUST NOT accept a per-entry signature as a substitute for the catalog seal.",
            "descriptions": [
              "The sealed catalog already binds every hash, and the seal's timestamp token time-anchors the batch — a per-file signature would add a signing round-trip and no trust. Hash-only entries are also privacy-preserving: only hashes ever leave the Vault."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#no-individual-signature"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "integrity-source",
                "value": "case-provenance/v1 seal + timestamp-token/v1"
              }
            ]
          },
          {
            "bom-ref": "artifact-classification",
            "identifier": "ART-011",
            "title": "Artifact Classification",
            "text": "An artifact entry SHOULD carry a cyberbench:kind property (seed values: audio, document, log, image) and a derived entry SHOULD carry a cyberbench:derivedKind property (seed values: transcript, extraction). Both are open sets: new values MAY be added without a version bump.",
            "descriptions": [
              "Kinds drive processing dispatch. Unlike the artifact class (ART-004, closed), these vocabularies are deliberately open — new media and derivation kinds arrive with new capability, not with a standards change."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#artifact-classification"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "kind-seed-values",
                "value": "audio,document,log,image"
              },
              {
                "name": "derived-kind-seed-values",
                "value": "transcript,extraction"
              },
              {
                "name": "vocabulary",
                "value": "open"
              }
            ]
          },
          {
            "bom-ref": "custody-event-linkage",
            "identifier": "ART-012",
            "title": "Custody Event Linkage",
            "text": "An artifact entry SHOULD carry a cyberbench:collectedEventSeq property: the integer sequence number of the custody event (custody-chain/v1) that recorded the artifact's collection or derivation.",
            "descriptions": [
              "This joins the catalog view (what exists) to the custody log view (what happened to it), so a verifier can walk from an entry to the event that brought it into the case."
            ],
            "parent": "artifact-entry-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/artifact-entry/v1#custody-event-linkage"
              },
              {
                "name": "validation-method",
                "value": "cross-reference"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/custody-chain/v1"
              }
            ]
          }
        ]
      }
    ]
  }
}