{
  "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:91768f00-73ef-471f-a71a-5e4936cba51b",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-11T00:00:00Z",
    "authors": [
      {
        "name": "Hypermedia Au Security Team"
      }
    ],
    "component": {
      "type": "data",
      "name": "Finding BOM Specification",
      "version": "1.0.0"
    },
    "properties": [
      {
        "name": "cyberbench:artifact-kind",
        "value": "BOM (L2 — one per promoted finding)"
      },
      {
        "name": "cyberbench:layer",
        "value": "L2"
      },
      {
        "name": "cyberbench:fullname",
        "value": "Finding BOM (promoted analyst conclusion; maker-signed; independently approved)"
      }
    ]
  },
  "definitions": {
    "standards": [
      {
        "bom-ref": "finding-v1.0.0",
        "name": "Hypermedia Security: Finding BOM Specification",
        "version": "1.0.0",
        "description": "The L2 Finding BOM: one per promoted finding, signed by its author, born at promotion. It turns a disposable transient analysis into a durable, non-repudiable, independently-approved deliverable: the finding document with its hash, the lineage back to the analysis it was promoted from, and one reference each to the attestation that authenticates it (analysis-provenance/v1) and the attestation that checks it (finding-approval/v1). Under changes-requested it is superseded by a new signed version linked to the old; nothing is edited in place, nothing is deleted.",
        "owner": "Hypermedia Au",
        "externalReferences": [
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/schemas/finding/v1.schema.json",
            "comment": "The BOM schema documents conforming to this standard validate against.",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "schema-url"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/publication/v1",
            "comment": "compositions (SPEC-12)",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "referenced-from"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/analysis-provenance/v1",
            "comment": "claims target it",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "referenced-from"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/finding-approval/v1",
            "comment": "claims target it",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "referenced-from"
              }
            ]
          },
          {
            "type": "documentation",
            "url": "https://cyclonedx.org/schema/bom-1.7.schema.json",
            "comment": "CycloneDX 1.7 — document mechanics (serialNumber/version, data component + hashes, enveloped JSF signature) verified from the schema file (SPEC-6)"
          },
          {
            "type": "documentation",
            "url": "https://www.rfc-editor.org/rfc/rfc2119",
            "comment": "RFC 2119 (as clarified by RFC 8174) — requirement key words; only capitalised forms are normative"
          },
          {
            "type": "website",
            "url": "https://sec.hypermedia.au"
          }
        ],
        "requirements": [
          {
            "bom-ref": "cyclonedx-document",
            "identifier": "FND-001",
            "title": "CycloneDX Document",
            "text": "A Finding BOM MUST be a CycloneDX 1.7 BOM with bomFormat 'CycloneDX', specVersion '1.7', a urn:uuid serialNumber, a positive integer version, metadata.timestamp (ISO-8601), and metadata.component naming the finding.",
            "descriptions": [
              "The serialNumber is the finding's permanent identity across its versions; the version advances only under the review loop (FND-006). BOM-Links from the approval attestation and from publications resolve against this document."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#cyclonedx-document"
              },
              {
                "name": "validation-method",
                "value": "schema"
              }
            ]
          },
          {
            "bom-ref": "finding-identity",
            "identifier": "FND-002",
            "title": "Finding Identity",
            "text": "metadata MUST carry cyberbench:caseId, cyberbench:findingId, and cyberbench:promotedFromAnalysis (the identifier of the transient analysis this finding was promoted from).",
            "descriptions": [
              "promotedFromAnalysis is the lineage back to the moment of promotion — the analysis run that became this finding. Most analyses are discarded and never enter the graph; promotion is the event that creates this object and freezes its provenance."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#finding-identity"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "required-fields",
                "value": "cyberbench:caseId,cyberbench:findingId,cyberbench:promotedFromAnalysis"
              }
            ]
          },
          {
            "bom-ref": "finding-document",
            "identifier": "FND-003",
            "title": "Finding Document",
            "text": "components[] MUST carry exactly one data component: the finding document, with a SHA-256 hash of its bytes and cyberbench:artifactClass 'finding'. The hash is the finding's integrity anchor and the value every BOM-Link to this finding pairs with.",
            "descriptions": [
              "One finding, one document, one hash. The document's hash is what the approval attestation approves (version-specific), what a publication composes, and what the Evidence Record covers at finalisation."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#finding-document"
              },
              {
                "name": "validation-method",
                "value": "cryptographic-hash"
              },
              {
                "name": "artifact-class",
                "value": "finding"
              }
            ]
          },
          {
            "bom-ref": "provenance-ref",
            "identifier": "FND-004",
            "title": "Provenance Reference",
            "text": "metadata MUST carry cyberbench:provenanceRef, resolving (BOM-Link + paired hash) to an analysis-provenance/v1 attestation whose claim targets this finding version. The Finding BOM's signing identity MUST equal the provenance attestation's author.",
            "descriptions": [
              "The finding and its authentication set are two signatures by the same maker over the same conclusion: the finding says what was concluded, the provenance says exactly what produced it. A finding whose provenanceRef does not resolve, or whose author identities diverge, fails verification."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#provenance-ref"
              },
              {
                "name": "validation-method",
                "value": "cross-reference + certificate-identity-comparison"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/analysis-provenance/v1"
              }
            ]
          },
          {
            "bom-ref": "approval-ref",
            "identifier": "FND-005",
            "title": "Approval Reference",
            "text": "metadata MUST carry cyberbench:approvalRef, resolving (BOM-Link + paired hash) to a finding-approval/v1 attestation targeting this finding version. For a finding to be disclosable — composed into a publication — that approval MUST be a current terminal finding-approved signed by an identity distinct from the author.",
            "descriptions": [
              "The checker side of maker-checker, referenced from the maker's object. The disclosability condition is enforced by the verifier at publication composition (it requires resolving the approval's predicate and comparing Fulcio identities, which no document schema can do)."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#approval-ref"
              },
              {
                "name": "validation-method",
                "value": "cross-reference (verifier)"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/finding-approval/v1"
              }
            ]
          },
          {
            "bom-ref": "versioning-and-supersession",
            "identifier": "FND-006",
            "title": "Versioning And Supersession",
            "text": "The version MUST bump when the review outcome is changes-requested: the author revises, producing a new signed Finding version with a new document hash, which links to and supersedes the prior version and re-enters review with a fresh analysis-provenance. The superseded version MUST be retained, marked superseded, and MUST NOT be edited or deleted.",
            "descriptions": [
              "Revision is a new object, never an edit — the review trail keeps every version and every signed outcome, so 'what changed and why' is always answerable from the record. References to a superseded version keep resolving (the hash proves the reviewed bytes); only the current version with a terminal approval is disclosable."
            ],
            "parent": "finding-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/finding/v1#versioning-and-supersession"
              },
              {
                "name": "validation-method",
                "value": "chain-verification (verifier)"
              },
              {
                "name": "trigger",
                "value": "finding-approval/v1 changes-requested"
              }
            ]
          }
        ]
      }
    ]
  }
}