7943cfb3af
Bundled pre-session doc + ops work: - docs/modules/**: sync across advisory-ai, airgap, cli, excititor, export-center, findings-ledger, notifier, notify, platform, router, sbom-service, ui, web (architectural + operational updates) - docs/features/**: updates to checked excititor vex pipeline, developer workspace, quick verify drawer - docs top-level: README, quickstart, API_CLI_REFERENCE, UI_GUIDE, code-of-conduct/TESTING_PRACTICES updates - docs/qa/feature-checks/: FLOW.md + excititor state update - docs/implplan/: remaining sprint updates + new Concelier source credentials sprint (SPRINT_20260422_003) - docs-archived/implplan/: 30 sprint archival moves (ElkSharp series, misc completed sprints) - devops/compose: .env + services compose + env example + router gateway config updates File-level granularity preserved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
SbomService
Status: Implemented
Source: src/SbomService/
Owner: Scanner Guild
Purpose
SbomService provides SBOM storage, versioning, and lineage tracking. Maintains the canonical SBOM repository with support for SPDX 3.0.1 and CycloneDX 1.6 formats, including temporal queries and dependency graph analysis.
Components
Services:
StellaOps.SbomService- Main SBOM service with API and business logic
Libraries:
StellaOps.SbomService.Storage.Postgres- PostgreSQL storage adapter for SBOM persistenceStellaOps.SbomService.Storage.Postgres.Tests- Storage layer integration tests
Configuration
Configuration is embedded in the service module settings.
Key settings:
- PostgreSQL connection (schema:
sbom_service) - Authority integration
- SBOM format support (SPDX, CycloneDX)
- Versioning and lineage policies
- Retention settings
Dependencies
- PostgreSQL (schema:
sbom_service) - Authority (authentication)
- Scanner (SBOM generation source)
- Attestor (SBOM attestation integration)
- ExportCenter (SBOM export and distribution)
Related Documentation
- Architecture:
./architecture.md - Scanner:
../scanner/ - Attestor:
../attestor/ - Data Schemas:
../../11_DATA_SCHEMAS.md
Current Status
Implemented with PostgreSQL storage backend. Supports SBOM ingestion, versioning, and lineage tracking. The host now expects durable PostgreSQL-backed state for all canonical runtime stores; fixture-backed and in-memory repositories are injected only by explicit test harnesses.