license switch agpl -> busl1, sprints work, new product advisories

docs/modules/concelier/sbom-learning-api.md

@@ -6,6 +6,22 @@ Per SPRINT_8200_0013_0003.
 
 The SBOM Learning API enables Concelier to learn which advisories are relevant to your organization by registering SBOMs from scanned images. When an SBOM is registered, Concelier matches its components against the canonical advisory database and updates interest scores accordingly.
 
+## SBOM Extraction
+Concelier normalizes incoming CycloneDX 1.7 and SPDX 3.0.1 documents into the internal `ParsedSbom` model for matching and downstream analysis.
+
+Current extraction coverage (SPRINT_20260119_015):
+- Document metadata: format, specVersion, serialNumber, created, name, namespace when present
+- Components: bomRef, type, name, version, purl, cpe, hashes (including SPDX verifiedUsing), license IDs/expressions, license text (base64 decode), external references, properties, scope/modified, supplier/manufacturer, evidence, pedigree, cryptoProperties, modelCard (CycloneDX)
+- Dependencies: component dependency edges (CycloneDX dependencies, SPDX relationships)
+- Services: endpoints, authentication, crossesTrustBoundary, data flows, licenses, external references (CycloneDX)
+- Formulation: components, workflows, tasks, properties (CycloneDX)
+- Build metadata: buildId, buildType, timestamps, config source, environment, parameters (SPDX)
+- Document properties
+
+Notes:
+- Full SPDX Licensing profile objects, vulnerabilities, and other SPDX profiles are pending in SPRINT_20260119_015.
+- Matching currently uses PURL and CPE; additional fields are stored for downstream consumers.
+
 ## Flow
 
 ```