- Introduced a new JSON fixture `receipt-input.json` containing base, environmental, and threat metrics for CVSS scoring. - Added corresponding SHA256 hash file `receipt-input.sha256` to ensure integrity of the JSON fixture.
Downgrade Adapters (SC4)
- Location for mapping CSVs converting CVSS v4→v3.1, CDX 1.7→1.6, SLSA 1.2→1.0.
- Each CSV must include BLAKE3 and SHA256 hash recorded in accompanying
hashes.txt. - Adapters are pure (no network); determinism enforced in CI.
- Files added:
mapping-cvss4-to-cvss3.csvmapping-slsa12-to-slsa10.csvmapping-cdx17-to-cdx16.csv(placeholder empty; fill once downgrade rules freeze).