What software is included?
Components, versions, dependencies and licenses associated with an application or release.
Context Bill of Materials
The evidence behind
AI-assisted code.
Connect coding-agent activity to the changes it produced. A Context BOM makes observed provenance portable—so reviewers can inspect the record and understand its limits.
CONTEXT BOMJSON / CLI EXPORT
{
"format": "secuarden-context-bom",
"version": "1.0",
"generated_at": "…",
"integrity": { … },
"components": [
{
"session_id": "…",
"agent": "…",
"file_path": "…",
"risk": { … }
}
]
}Illustrative structure · abbreviated fields
Where it fits
Three questions. Connected evidence.
Software inventory, AI inventory and development provenance give reviewers different views of the same product.
What AI is involved?
Models, providers, frameworks and model characteristics, with dataset information where available.
What evidence explains the change?
Observed agent activity, file outcomes and supporting records, with explicit boundaries around what is known.
These scopes overlap. CycloneDX and SPDX already support provenance and relationships. Context BOM focuses on AI-assisted development evidence.
The CLI foundation
Take the evidence
with the change.
The CLI export brings together captured file-write provenance, session references and integrity results in a JSON document for review.
secuarden c-bom --since 30d > context-bom.jsonThe renamed command is implemented on the Context BOM development branch. Release availability depends on your installed CLI version.
Explore Secuarden CLI →- Session & event referencesTrace a record back to its captured activity.
- Agent & model contextIdentify the agent and available model metadata.
- Repository & developerInclude recorded repository, branch and identity context.
- File-write outcomesExport observed successful, completed file writes.
- Hashes & integrityInclude available content hashes and event-chain checks.
- Risk signalsCarry deterministic assessments and contributing reasons.
PROPOSED SPECIFICATION · DRAFT 0.1
More context. Clearer boundaries.
The proposed specification extends the CLI foundation into a manifest of context inputs, actors, actions and explicit decisions. Each connection carries its evidence basis, and each record declares capture gaps.
Available
A file or instruction was accessible in the environment.
Read observed
The capture system observed a read operation.
Supplied to an agent
Evidence shows the input crossed an agent context boundary.
These are distinct observations. None alone proves that an input influenced the resulting code.
Separate facts from inference
Identify whether a relationship was observed, asserted or inferred. Record explicit decisions only when supporting evidence exists.
Make the gaps visible
Distinguish partial capture, unsupported observations and unknown outcomes. An intact event chain can still describe an incomplete record.
Keep content optional
The draft proposes metadata-only export by default, with explicit treatment of identities, paths and sensitive content.
Reading the evidence
Know what the record establishes.
Does a verified record mean complete capture?
No. Integrity checks establish whether recorded evidence passes the applicable checks. They do not establish that every action was captured, that the code is correct, or that a developer approved it.
Does Context BOM contain source code or prompts?
The existing file-provenance export contains metadata, available hashes and risk assessments rather than source-file bodies. Paths and identities may still be sensitive. The draft does not require raw prompts or source content for conformance.
Is a session automatically bound to a commit?
No. Session activity and revision association are separate claims. The proposed revision-bound profile requires exact repository and revision identities plus evidence connecting activity to that change.
Does it replace an SBOM or AI BOM?
No. Context BOM complements software and AI inventories. The draft proposes references to related BOMs and attestations; it does not claim SPDX or CycloneDX conformance.
From activity to reviewable evidence
Give your code changes context.
Explore the local capture foundation, or talk with us about the evidence your team needs to review AI-assisted development.