[Phase 16] Write the SBOM / supply-chain standard (prerequisite of S12)
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 18/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- markdown, python
- Domain
- documentation, security
Research direction
Read the Phase 16 roadmap at docs/roadmap/phase-16-trust-surface-hardening.md lines 904-908, the layout rules in documentation.md, and the severity handling in check_pip_audit.py. The standard goes under docs/standards/ and is linked from docs/standards/README.md. Done means every decision (CycloneDX version, completeness rules, retention, severity tiers) is a checkable rule and S12 can be reviewed against it.
Written by the indexing model from the issue text.
Description
Roadmap · Phase 16 · prerequisite of step S12 · size M · planned in
docs/roadmap/phase-16-trust-surface-hardening.md:904-908
Summary
SBOMs appear only as descriptive prose and one command; nothing states what a correct SBOM is or what the supply-chain gates mean. Phase 16 S12 has nothing to be reviewed against until this exists.
What the standard must settle
- The CycloneDX version.
- Component completeness: root exclusion,
bom-refuniqueness, license coverage, dependency graph. - The retention channel and window.
- The meaning of each
check_pip_audit.pyseverity tier.
Acceptance criteria
- The standard lives under
docs/standards/in the layoutdocumentation.mdprescribes and is listed indocs/standards/README.md. - It answers every point above with a rule a reviewer can check, not a description.
- Phase 16 step S12 can be reviewed against it.
Planned in docs/roadmap/phase-16-trust-surface-hardening.md (read at f94595f). Unit IDs (F-W20260729-…) come from the 2026-07-29/30 full-project review; the issue numbers next to them are the October 2026 review's records of the same defects.
- Dominant language
- Python
- Stars
- 9
- Forks
- 1
- Avg merge
- 8h 10m
- Merged PRs (30d)
- 5
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HodeTech/ForgeLM
-
area: dev-tooling bug severity: low source: roadmap wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Site: the theme-locked --code-comment grey (#6a6f80) on the dark code surface is 3.8:1, below WCAG AA, in both themes (F-W1-SITE-06)Possibly taken @vortsghost2025 claimed this 1 day ago. Openarea: site bug good first issue severity: low source: review-2026-09 wave: 4
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
-
documentation good first issue severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
documentation good first issue severity: low source: review-2026-09 wave: 4
Difficulty 1/5 1-3 hours Newbie friendliness 80/100
-
documentation severity: medium source: review-2026-09 wave: 3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
All issues in HodeTech/ForgeLM
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
-
[Bug]: Importing weave changes the process-wide localePossibly taken @himanshu748 claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
UX
Difficulty 1/5 Under an hour Newbie friendliness 72/100
mediajunkie/piper-morgan-product#2008 · 2 comments ·