{
  "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:be221ac8-e4c9-46da-9ac5-0af64c4e97fa",
  "version": 1,
  "metadata": {
    "timestamp": "2026-07-11T00:00:00Z",
    "authors": [
      {
        "name": "Hypermedia Au Security Team"
      }
    ],
    "component": {
      "type": "data",
      "name": "Publish Approval Specification",
      "version": "1.0.0"
    },
    "properties": [
      {
        "name": "cyberbench:artifact-kind",
        "value": "attestation (declarations document; maker-checker at the release boundary; L3)"
      },
      {
        "name": "cyberbench:fullname",
        "value": "Publish Approval (release maker-checker; approver distinct from report author)"
      },
      {
        "name": "cyberbench:claim-predicates",
        "value": "approved-for-disclosure,disclosure-rejected,changes-requested"
      }
    ]
  },
  "definitions": {
    "standards": [
      {
        "bom-ref": "publish-approval-v1.0.0",
        "name": "Hypermedia Security: Publish Approval Specification",
        "version": "1.0.0",
        "description": "The publish-approval attestation: maker-checker at the release boundary. The report author signs the Publication (the maker side); here an approver whose Fulcio identity differs from the author signs the disclosure decision. Three predicates, mirroring finding-approval by design: approved-for-disclosure (terminal — the report may be delivered, and a delivered publication is frozen), disclosure-rejected (terminal — kept, marked rejected), changes-requested (non-terminal — a new publication version follows via its supersedes link). At release the approver re-verifies the composition: every disclosed finding enumerated and disclosable. This is the last standard in the CyberBench case-provenance pack.",
        "owner": "Hypermedia Au",
        "externalReferences": [
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/attestations/publish-approval/v1",
            "comment": "The attestation schema enforcing this standard.",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "attestation-schema"
              }
            ]
          },
          {
            "type": "other",
            "url": "https://sec.hypermedia.au/standards/publication/v1",
            "comment": "claim target; completes the CyberBench case-provenance pack (13 of 13)",
            "properties": [
              {
                "name": "cyberbench:role",
                "value": "references"
              }
            ]
          },
          {
            "type": "documentation",
            "url": "https://www.iso.org/standard/73896.html",
            "comment": "ISO 21043-5:2025 (Forensic sciences — Part 5: Reporting) — cited at title/scope level (clause text not verified first-hand): includes requirements relating to the review of case records and reports and the issuance and control of reports — the duties the release approval and the delivered-is-frozen rule discharge"
          },
          {
            "type": "documentation",
            "url": "https://www.rfc-editor.org/rfc/rfc3161.html",
            "comment": "RFC 3161 — the publication-seal's independent-time anchor, governed by timestamp-token/v1 (SPEC-2)"
          },
          {
            "type": "documentation",
            "url": "https://www.rfc-editor.org/rfc/rfc2119",
            "comment": "RFC 2119 (as clarified by RFC 8174) — requirement key words; only capitalised forms are normative"
          },
          {
            "type": "website",
            "url": "https://sec.hypermedia.au"
          }
        ],
        "requirements": [
          {
            "bom-ref": "approver-identity",
            "identifier": "PAPP-001",
            "title": "Approver Identity",
            "text": "assessors[] MUST identify the approver, and the attestation MUST be signed by that identity (Fulcio-verified).",
            "descriptions": [
              "The release decision is attributed to a named, cryptographically bound actor — who let the report out is part of the record, exactly as who wrote it is."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#approver-identity"
              },
              {
                "name": "validation-method",
                "value": "certificate-identity-comparison"
              }
            ]
          },
          {
            "bom-ref": "target-publication-reference",
            "identifier": "PAPP-002",
            "title": "Target Publication Reference",
            "text": "The attestation MUST carry exactly one claim whose target is the L3 Publication version by BOM-Link and paired hash. The hash binds the release decision to the exact report bytes reviewed.",
            "descriptions": [
              "Version-specific by construction: the approval covers the bytes the approver read, not a mutable pointer. A revised report is a new publication version needing its own release decision."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#target-publication-reference"
              },
              {
                "name": "validation-method",
                "value": "cross-reference"
              }
            ]
          },
          {
            "bom-ref": "approver-distinct-from-author",
            "identifier": "PAPP-003",
            "title": "Approver Distinct From Author",
            "text": "The approver's Fulcio identity MUST differ from the report author's. This MUST be enforced by comparing two Fulcio-verified identities, never by comparing name strings, and MUST be asserted as a map row. The verifier performs the comparison against the Publication's signing identity.",
            "descriptions": [
              "The single-author-fraud control at the outermost boundary: the person who wrote the report cannot be the person who releases it. Cryptographic identity, not a name, is what makes the separation unfakeable."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#approver-distinct-from-author"
              },
              {
                "name": "validation-method",
                "value": "certificate-identity-comparison (verifier)"
              }
            ]
          },
          {
            "bom-ref": "approval-predicate",
            "identifier": "PAPP-004",
            "title": "Approval Predicate",
            "text": "The claim predicate MUST be exactly one of: approved-for-disclosure (terminal — the publication may be delivered), disclosure-rejected (terminal — retained, marked rejected), changes-requested (non-terminal — returns to the report author; a new publication version follows, linked via cyberbench:supersedes). Closed set. A delivered publication MUST be the version carrying approved-for-disclosure and MUST NOT change after delivery.",
            "descriptions": [
              "The same review machine as finding-approval, with the report vocabulary — the send-back state exists here by deliberate mirroring, so iterative review of a report is as defensible and as signed as iterative review of a finding. Delivered-is-frozen makes 'which report did you give them' a question with exactly one answer."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#approval-predicate"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "allowed-values",
                "value": "approved-for-disclosure,disclosure-rejected,changes-requested"
              },
              {
                "name": "terminal",
                "value": "approved-for-disclosure,disclosure-rejected"
              },
              {
                "name": "non-terminal",
                "value": "changes-requested"
              },
              {
                "name": "vocabulary",
                "value": "closed (locked v1.0.0)"
              }
            ]
          },
          {
            "bom-ref": "approval-rationale",
            "identifier": "PAPP-005",
            "title": "Approval Rationale",
            "text": "The claim MUST carry a non-empty reasoning field stating the basis for the release decision, for every predicate including changes-requested.",
            "descriptions": [
              "The rationale is what shows a real release review happened — the reviewer's own words on why this report, with these findings, may (or may not) leave the enclave. ISO 21043-5's review-of-reports duty is discharged in this field."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#approval-rationale"
              },
              {
                "name": "validation-method",
                "value": "schema"
              },
              {
                "name": "iso-basis",
                "value": "ISO 21043-5:2025 review of case records and reports (title/scope level)"
              }
            ]
          },
          {
            "bom-ref": "findings-enumerated",
            "identifier": "PAPP-006",
            "title": "Findings Enumerated",
            "text": "Before signing approved-for-disclosure, the approver MUST verify that the Publication's compositions carry aggregate complete, that the assemblies enumerate every finding the report discloses, and that each composed finding is disclosable: a current terminal finding-approved from an identity distinct from that finding's author. This verification MUST be asserted as a map row.",
            "descriptions": [
              "The release-time re-check of the whole chain: nothing reaches the recipient that is not enumerated, and nothing enumerated lacks its own independent approval. Together with the publication's own completeness claim this is the double lock on undisclosed or unapproved content."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#findings-enumerated"
              },
              {
                "name": "validation-method",
                "value": "cross-reference (verifier)"
              },
              {
                "name": "composition-standard",
                "value": "https://sec.hypermedia.au/standards/publication/v1#complete-composition"
              },
              {
                "name": "disclosability",
                "value": "https://sec.hypermedia.au/standards/finding-approval/v1#supersession-and-invariant"
              }
            ]
          },
          {
            "bom-ref": "independent-timestamp",
            "identifier": "PAPP-007",
            "title": "Independent Timestamp",
            "text": "The publication-seal's RFC 3161 token SHOULD exist in the sidecar index and verify per timestamp-token/v1 at the time of attestation. Where the token is not yet available, the attestation MUST record that the anchor is pending.",
            "descriptions": [
              "SHOULD, not MUST, for the same reason as the catalog attestation's anchor row: the token arrives from an external service moments after the seal, and the attestation may be produced before the round-trip completes. The token itself remains mandatory at the timestamp-token/v1 level — this row records whether the release approver could already verify it."
            ],
            "parent": "publish-approval-v1.0.0",
            "properties": [
              {
                "name": "requirement-uri",
                "value": "https://sec.hypermedia.au/standards/publish-approval/v1#independent-timestamp"
              },
              {
                "name": "validation-method",
                "value": "sidecar-join + asn1-verification"
              },
              {
                "name": "level",
                "value": "SHOULD"
              },
              {
                "name": "target-standard",
                "value": "https://sec.hypermedia.au/standards/timestamp-token/v1"
              }
            ]
          }
        ]
      }
    ]
  }
}