[HackTuah]

Two questions a reviewer or a deployment should be able to answer from the artifact alone, without asking anyone: what is inside this build, and where did it come from. Neither had an answer before this slice.

What is inside

mix trinity.sbom runs sbom's CycloneDX generator over mix.lock, then makes two corrections to what it produced.

Coverage, stated inside the document. mix.lock knows Hex dependencies and knows nothing about the Rust crates the desktop shell links. A reader who took the bill for the whole picture would conclude there is no Rust in the product. The coverage statement is therefore a metadata.properties entry in the bill itself, where anyone reading the file alone finds it, rather than a paragraph in a page beside it.

Licence identifiers, found by validating rather than by reasoning. CycloneDX validates license.id against the SPDX enumeration and rejects the whole document over one bad value. A Hex package's licenses metadata is free text its author typed, and sbom emits a lone licence string as an id without checking it. yamerl declares BSD 2-Clause where SPDX spells BSD-2-Clause, and the official CycloneDX validator refused the first bill this project ever generated over that single field:

$ docker run --rm -v "$PWD:/w:ro" -w /w cyclonedx/cyclonedx-cli:latest \
    validate --input-file sbom.cdx.json --input-format json --fail-on-errors
On instance: /components/62/licenses/0/license:
{ "acknowledgement": "declared", "id": "BSD 2-Clause" }
Value should match one of the values specified by the enum
BOM is not valid.
exit=1

Any identifier not in the SPDX list vendored at priv/spdx/license-ids.txt is now recorded as a licence name instead, which is where CycloneDX puts a licence it cannot resolve. Nothing is dropped and nothing is guessed: the text is kept, it simply stops claiming to be an identifier it is not. After the fix, the same command exits 0.

The vendored list carries its source URL, its ref and its sha256 in its own header, and it fails safe in one direction: an identifier added to SPDX after the date recorded there is demoted to a name, which is still valid CycloneDX. The reverse mistake is the one that invalidates a bill, and the list prevents it.

The gate generates the bill on every commit, so a bill that cannot be produced fails the build rather than being missing from a release nobody checked.

Where it came from

The package workflow uploads the bill beside each platform's binary and attests each artifact through GitHub's workflow identity, recorded in the public transparency log. gh attestation verify then checks the attestation in the same job that produced it and writes the result to the run summary, because an attestation nobody checks is a file rather than an assurance.

Transport

One README paragraph states the TLS floor and the one message authentication code Trinity mints, pinned by tests against :ssl.versions/0 and against the envelope's source rather than against the sentence, so the line cannot outlive the fact.

The assurance case

docs/10-assurance-case.md C8 stated in writing that this project published no bill of materials. A gap stated in an assurance case is a promise to close it, so C8 is corrected with the rest of the work. What remains is narrower and is still stated: the Rust crate half is slice 121's, and signing is slice 101's.

Evidence

• mix gate exit 0; 575 passed, 18 excluded; coverage 80.31%.
• 9 tests in test/supply_chain_test.exs covering AC1 and AC3.
• The CycloneDX validator's command and exit code, before and after, above.