An SBOM on every build
The software bill of materials is produced by the build itself, not reconstructed afterwards from an artifact.
Pillar
Supply-chain assurance
The chain becomes verifiable end to end because the platform holds both ends.
In detail
Signing and transparency log
COSE / DSSE signing and an append-only chained log. The “signed” field reads unknown until a verification has taken place: no assurance field has a favourable default.
Dependencies and secrets
Dependency analysis and secret detection at build time and at push time. An unmeasured result is declared unmeasured.
Admission policies
A policy decides what reaches production, and a refusal carries a named reason. A policy that cannot refuse proves nothing.