feat(supply-chain): SPDX and CycloneDX imports with derived SPDX export

[balcsida]

Summary

Milestone 4. Depends on #109.

• POST /v1/supply-chain/imports – SPDX 2.3 JSON and CycloneDX 1.6 JSON only; format detected from the document (a contradicting Content-Type is rejected), other formats/versions rejected with 415 unsupported_format. Each (subject, label) is its own import:<subject>:<label> stream, so a container SBOM never replaces the GitHub observation and an old artifact upload never becomes the current source inventory. Original bytes preserved; uploader recorded separately from the claimed producer (a Tool: ORT string grants nothing); an optional subject_revision is bound only as producer_asserted; idempotent on identical bytes; per-repository quota; non-administrators need a repository-scoped upload grant (PUT /v1/supply-chain/upload-grants). External URLs inside documents are never dereferenced.
• CycloneDX 1.6 normalizer – nested components flattened with CONTAINS edges, dependencies → DEPENDS_ON, hashes, suppliers, purl qualifiers; license choices kept as the format carries them (a list of license objects has no AND/OR meaning and is kept as a list with a warning); component evidence and inline license text stay only in the preserved original and are flagged (evidence_not_carried, license_text_inline). Fuzzed.
• Derived SPDX export GET /v1/supply-chain/exports/{id}/derived.spdx.json – GraphNest as creator, links the preserved original by URL + SHA-256 (externalDocumentRefs), assessments only as licenseComments, licenseConcluded always NOASSERTION, validated by GraphNest's own reader before serving. The original download is never altered.
• Docs – producer examples for Syft (CycloneDX) and ORT (SPDX), what is and is not carried (no native ScanCode/Code Insight adapter is claimed). Migration 035.

Verification

Integration tests: real-format round trips for both formats, stream separation, uploader vs claimed producer, spoofed GitHub tool string lands only in an import stream, producer-asserted binding, idempotency, quota per repository, permission matrix (admin / granted / ungranted / reader / unknown repo), explicit rejections (old versions, mismatched claim, unknown format, malformed, bad label/subject/revision, wrong media type), derived export structure and original preservation.

Implications

• Migration: 035 additive (imports, upload grants, uploaded_by/upload_label on snapshots).
• Security: documented trust boundaries in the operations guide.

---

Part of the Dependencies & Licenses stack (native GitHub stack #114, ten layers, main ← #104 ← #105 ← #106 ← #107 ← #108 ← #109 ← #110 ← #111 ← #112 ← #113). Design: ADR-0017; living plan with the full validation table: docs/execplans/supply-chain.md. All commits are SSH-signed. Nothing here calls a live GitHub Enterprise Server or a live package registry; GitHub and registry behavior is exercised against fixtures and fake servers only.

_{Stack created with GitHub Stacks CLI}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.