{
  "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:2a2b66d1-38dc-4610-9673-7c815479bdaf",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-11T00:00:00Z",
    "authors": [
      {
        "name": "Hypermedia Au Security Team"
      }
    ],
    "component": {
      "type": "data",
      "name": "Case Catalog Integrity Specification",
      "version": "1.0.0"
    },
    "properties": [
      {
        "name": "cyberbench:artifact-kind",
        "value": "attestation (declarations document; one per seal)"
      },
      {
        "name": "cyberbench:fullname",
        "value": "Case Catalog Integrity (complete enumeration + hashes recomputed at seal)"
      },
      {
        "name": "cyberbench:claim-predicate",
        "value": "catalog-integrity-verified"
      }
    ]
  },
  "definitions": {
    "standards": [
      {
        "bom-ref": "case-catalog-v1.0.0",
        "name": "Hypermedia Security: Case Catalog Integrity Specification",
        "version": "1.0.0",
        "description": "The catalog-integrity attestation: one per seal, the signed statement that the catalog version produced by that seal is complete (every artifact in the corpus is enumerated) and hash-true (every content hash recomputed from the Vault bytes and matched at the moment of sealing). Where custody-chain/v1 testifies to the case's history, case-catalog/v1 testifies to the snapshot — together they are the two attestations the Case Provenance BOM carries. Named case-catalog to remain distinct from the deployment-pipeline catalog-integrity standard in this authority.",
        "owner": "Hypermedia Au",
        "externalReferences": [
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/attestations/case-catalog/v1",
            "comment": "The attestation schema enforcing this standard.",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "attestation-schema"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/case-provenance/v1",
            "comment": "its second attestation; the first is custody-chain/v1",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "referenced-from"
              }
            ]
          },
          {
            "type": "documentation",
            "url": "https://www.iso.org/standard/44381.html",
            "comment": "ISO/IEC 27037:2012 — §5.4.4: original and copy verified with a proven verification function producing the same output (the hash-recomputation duty behind #hash-at-seal); §6.1 custody record identity/integrity — verified against the standard text 2026-07-11 (SPEC-5 note)"
          },
          {
            "type": "documentation",
            "url": "https://www.iso.org/standard/44407.html",
            "comment": "ISO/IEC 27043:2015 — §11.3: each process performed should be documented to assure repeatability/reproducibility and preserve chain of custody — the concurrent-documentation duty a per-seal integrity attestation discharges; verified against the standard text 2026-07-11 (SPEC-6 note)"
          },
          {
            "type": "documentation",
            "url": "https://cyclonedx.org/schema/bom-1.7.schema.json",
            "comment": "CycloneDX 1.7 — the JSF signature definition verified for the seal-signature row (SPEC-6)"
          },
          {
            "type": "documentation",
            "url": "https://www.rfc-editor.org/rfc/rfc2119",
            "comment": "RFC 2119 (as clarified by RFC 8174) — requirement key words; only capitalised forms are normative"
          },
          {
            "type": "website",
            "url": "https://sec.hypermedia.au"
          }
        ],
        "requirements": [
          {
            "bom-ref": "target",
            "identifier": "CCAT-001",
            "title": "Target",
            "text": "The attestation MUST carry exactly one claim whose target is the sealed Case Provenance BOM version by BOM-Link and paired hash, and whose predicate is catalog-integrity-verified. One attestation MUST be issued at every seal — one per catalog version.",
            "descriptions": [
              "The claim binds the verification to one specific sealed version: 'the catalog is intact' is meaningless without saying which catalog, at which seal. The predicate is a stable machine identifier from the locked v1.0.0 vocabulary."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#target"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "predicate",
                "value": "catalog-integrity-verified"
              },
              {
                "name": "cardinality",
                "value": "one-per-seal"
              }
            ]
          },
          {
            "bom-ref": "complete-enumeration",
            "identifier": "CCAT-002",
            "title": "Complete Enumeration",
            "text": "At the seal, every artifact in the case corpus MUST appear as a component of the sealed catalog. The attestation MUST record the enumeration check as evidence; any artifact present in the Vault but absent from the catalog MUST abort the seal.",
            "descriptions": [
              "Completeness is what turns the catalog from a list into an index of record: a verifier who trusts this attestation knows the sealed components array is the whole corpus, not a selection. ISO/IEC 27043 §11.3's concurrent-documentation duty — each process documented to preserve custody — is discharged per seal by exactly this check."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#complete-enumeration"
              },
              {
                "name": "validation-method",
                "value": "corpus-comparison"
              },
              {
                "name": "iso-basis",
                "value": "ISO/IEC 27043 §11.3"
              }
            ]
          },
          {
            "bom-ref": "hash-at-seal",
            "identifier": "CCAT-003",
            "title": "Hashes Recomputed At Seal",
            "text": "At the seal, every content hash enumerated in the catalog MUST be recomputed from the Vault bytes and matched against the catalog's value. A single mismatch MUST abort the seal. The attestation MUST record the hash-check outcome as evidence.",
            "descriptions": [
              "This is ISO/IEC 27037 §5.4.4's verification-function duty applied at every checkpoint: the original and the record produce the same verification output. It is also what makes hash-only artifact entries safe — the seal is the moment their hashes are proven against the actual bytes, batch-wide."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#hash-at-seal"
              },
              {
                "name": "validation-method",
                "value": "cryptographic-hash"
              },
              {
                "name": "iso-basis",
                "value": "ISO/IEC 27037 §5.4.4"
              }
            ]
          },
          {
            "bom-ref": "seal-signature",
            "identifier": "CCAT-004",
            "title": "Seal Signature Verified",
            "text": "The sealed catalog's JSF signature MUST verify against the Fulcio root and certificate chain at the time of attestation.",
            "descriptions": [
              "The integrity claim covers a signed object: attesting a catalog whose own seal does not verify would be attesting the wrong bytes. The signature mechanics are governed by case-provenance/v1 (#seal-signature); this row is the independent re-check of them."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#seal-signature"
              },
              {
                "name": "validation-method",
                "value": "cryptographic-signature"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/case-provenance/v1#seal-signature"
              }
            ]
          },
          {
            "bom-ref": "operator-identity",
            "identifier": "CCAT-005",
            "title": "Operator Identity",
            "text": "The catalog's metadata.authors[] MUST match the identity in the sealing certificate, and the attestation's assessor MUST be that same identity. All identity comparisons MUST be made between Fulcio-verified identities, never name strings.",
            "descriptions": [
              "The sealing operator attests their own seal — this is the snapshot check, not maker-checker (which applies to findings and publications, where a second identity signs). What this row proves is that the name on the record and the key that sealed it are the same actor, per ISO/IEC 27037's handler-attribution duty."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#operator-identity"
              },
              {
                "name": "validation-method",
                "value": "certificate-identity-comparison"
              },
              {
                "name": "iso-basis",
                "value": "handler attribution — ISO/IEC 27037 §6.1 (synthesis, per SPEC-5 note)"
              }
            ]
          },
          {
            "bom-ref": "external-seal-anchor",
            "identifier": "CCAT-006",
            "title": "External Seal Anchor",
            "text": "The seal's RFC 3161 token SHOULD exist in the sidecar index and verify per timestamp-token/v1 at the time of attestation. Where the token is not yet available (intermittent connectivity), the attestation MUST record that the anchor is pending.",
            "descriptions": [
              "SHOULD, not MUST, because the token is obtained from an external service moments after sealing — the attestation may be produced before the round-trip completes. The token remains mandatory at the timestamp-token/v1 level; this row is about whether the catalog-integrity assessor could already verify it."
            ],
            "parent": "case-catalog-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/case-catalog/v1#external-seal-anchor"
              },
              {
                "name": "validation-method",
                "value": "sidecar-join + asn1-verification"
              },
              {
                "name": "level",
                "value": "SHOULD"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/timestamp-token/v1"
              }
            ]
          }
        ]
      }
    ]
  }
}