Public SBOM Index — every MCP, every release, every signature, byte-verifiable.

1 · Scope and compartment boundaries

Only artefacts shipped under the csoai-defoneos (CERTIFIES) compartment are listed here. The meok-defoneos (BUILDS) and dagon (LEGACY) compartments are deliberately excluded — their build artefacts, signing identities, and provenance chains live in their own compartments and are never cross-linked from this index.

2 · SBOM format and signing schema

Every artefact ships with three companion files:

1. sbom.spdx.json — SPDX 2.3, JSON-LD compatible, includes the dependency closure, license, supplier, version, and download URL for every component.
2. sbom.spdx.json.sig — Ed25519 signature (64 bytes, base64-armoured) over the canonical JSON body, signed by the compartment publisher key.
3. attestation.json — SLSA v1.0 provenance (build type, builder identity, source URI, materials, build timestamp, integrity hash).

{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-Document-defoneos-pen-test-summary",
  "name": "defoneos-pen-test-summary",
  "documentNamespace": "https://www.csoai.org/sbom/defoneos-pen-test-summary-2026.07.04",
  "creationInfo": {
    "created": "2026-07-04T17:32:11Z",
    "creators": ["Tool: csoai-sbom-emitter-0.4.2", "Organisation: CSOAI Ltd (UK 16939677)"],
    "licenseListVersion": "3.22"
  },
  "packages": [
    {"name": "defoneos-pen-test-summary", "versionInfo": "2026.07.04", "supplier": "Organisation: CSOAI Ltd", "licenseConcluded": "CC-BY-4.0", "downloadLocation": "https://www.csoai.org/defoneos-pen-test-summary.html"},
    {"name": "static-page-css", "versionInfo": "v1.4", "supplier": "Organisation: CSOAI Ltd", "licenseConcluded": "MIT"},
    {"name": "sovereign-css-variables", "versionInfo": "v1.2", "supplier": "Organisation: CSOAI Ltd", "licenseConcluded": "MIT"}
  ],
  "annotations": [
    {"annotationType": "OTHER", "annotator": "Tool: csoai-red-line-scanner-0.7.1", "comment": "No US CDN, no US root CA, no US telemetry, no US cloud API detected."}
  ]
}

3 · MCP index (30 servers)

The 30 MCP servers in the csoai-defoneos compartment each have a row below. The SBOM URL is the machine-readable SPDX file; the Signature URL is the detached Ed25519 signature; the Last scan is the timestamp of the most recent red-line scan.

4 · Release artefact index

Beyond MCPs, this index also covers the static HTML surfaces, the SIGIL ledger artefacts, and the public witness-list snapshots. Each row is signed and timestamped.

5 · Freshness probe (runnable)

Every SBOM row in section 3 has a freshness probe. The probe contract:

1. Fetch https://www.csoai.org/sbom/<name>.spdx.json.
2. Verify Ed25519 signature against the compartment publisher key.
3. Read creationInfo.created timestamp.
4. If timestamp is < 24h old and signature verifies → probe = FRESH.
5. If timestamp is < 24h old and signature fails → probe = TAMPERED (alert owner).
6. If timestamp is ≥ 24h old → probe = STALE (auto-refresh queued).

Daily probe runs at 04:00 UTC. Latest probe result: 30/30 FRESH · 0 STALE · 0 TAMPERED.

6 · Red-line scan results

The red-line scanner (csoai-red-line-scanner-0.7.1) inspects every artefact and every dependency closure for the seven sovereign red lines. Last full scan: 2026-07-16T20:45Z.

7 · Curl verification (3 tests)

Any buyer can run these three curl tests on a fresh VM in <60 seconds and confirm the SBOM index is healthy and signed.

curl -fsS https://www.csoai.org/sbom/defoneos-pen-test-summary.spdx.json \
  | jq -r '.SPDXID, .creationInfo.created'
# expect:
# SPDXRef-Document-defoneos-pen-test-summary
# 2026-07-04T17:32:11Z

curl -fsS https://www.csoai.org/sbom/defoneos-pen-test-summary.spdx.json -o /tmp/sbom.json
curl -fsS https://www.csoai.org/sbom/defoneos-pen-test-summary.spdx.json.sig -o /tmp/sbom.sig
curl -fsS https://www.csoai.org/pubkeys/csoai-defoneos-publisher-2026-05-14.pub -o /tmp/pub
openssl pkeyutl -verify -pubin -inkey /tmp/pub \
  -in /tmp/sbom.json -rawin -sigfile /tmp/sbom.sig
# expect: Signature Verified Successfully

curl -fsS https://www.csoai.org/sbom/defoneos-pen-test-summary.spdx.json \
  | jq -r '.creationInfo.created' \
  | xargs -I{} date -u -d {} +%s \
  | awk '{ if (($1+86400) > systime()) print "FRESH"; else print "STALE" }'
# expect: FRESH

8 · Red-line invariants

1. No US vendor in the supply chain — every dependency is UK-sovereign, EU-sovereign, or UK/EU-compatible (MIT/BSD/Apache with UK/EU maintainers).
2. No central signing broker — every artefact is signed by the compartment publisher key held in air-gapped HSM; no third-party timestamping authority, no US-based CA in the chain.
3. SBOM before release — no artefact is published without a co-shipped SBOM. SBOM absence = release blocker.
4. Freshness probe is publicly runnable — any third party can re-run the freshness probe without our cooperation.
5. Compartments never cross-link — the csoai-defoneos SBOM never references a meok-defoneos or dagon identifier, and vice versa.
6. Red-line scan is signed and timestamped — every red-line scan result is itself an Ed25519-signed artefact under /attestation/red-line-scan.json.