SBOM & VEX

Measure coverage against what the runtime platform says is running, not what your pipelines produced. Then choose deliberately: make the recorded path the only route to production, or accept a measured gap with a named owner.

Treat trimming as a non-repudiation problem, not an inventory one. Remove the human hands between generation and delivery: the delivered document is the generated artefact, bound to the artefact digest, retained, and independently re-derived for a sample of releases.

Tier by what a supplier can reach if it goes wrong and how replaceable it is, not by contract value. Demand most from software running inside your trust boundary, and ask operators with standing production access for access evidence instead.

Not verbatim. Authoring a statement makes you the accountable party, and a supplier's justification was evaluated against the supplier's build, not your composition. Pass through only structural claims; re-evaluate every configuration-dependent one.

You cannot compute identity for someone else's build, so the levers are contractual: require a component-level SBOM and a product-keyed advisory channel as purchase terms. Until then, record one opaque component and spend on containment.

Default to build-time generation inside shared pipeline templates, since it has the highest fidelity. Fall back to artifact analysis at the registry for everything else, and require a document contractually for artifacts a supplier builds.