# AGENTS
## Role
Normalize CycloneDX VEX documents and expose serialization utilities for CycloneDX-based exports.
## Scope
- Parsing of CycloneDX VEX statements (`analysis.state`, `justification`, `impact`) into canonical claims.
- Utilities to align SBOM references (components, services) with policy expectations.
- Export builders that emit CycloneDX-compliant VEX bundles or augment existing SBOMs.
- Validation against CycloneDX schema versions and namespace compatibility.
## Participants
- Connectors ingesting CycloneDX VEX or SBOM attestations send documents here for normalization.
- Export module uses serializers to produce CycloneDX JSON/JSONL as requested.
- Policy/consensus logic depends on status/justification mapping provided here.
## Interfaces & contracts
- Normalizer implementations, component reference mapping helpers, export serializers.
- Schema validation adaptor for offline mode and fixture-driven testing.
## In/Out of scope
In: CycloneDX parsing, normalization, export writing, schema validation.
Out: Connector transport, storage, attestation; these rely on other modules.
## Observability & security expectations
- Log schema mismatches with document digest and component references; avoid logging proprietary component details where possible.
## Tests
- Unit and fixture tests will live in `../StellaOps.Vexer.Formats.CycloneDX.Tests`, covering normalization and serialization determinism.
