Software bills of materials

One CycloneDX 1.5 file per deployable part, generated by scripts/security/generate-sbom.sh (syft over the lockfiles, no node_modules needed) and committed so a reviewer reads the bill next to the code it describes. --check fails when a committed bill no longer matches the lockfiles, which is how a dependency change that forgot the bill is caught.

File	What	Source of truth
ui.cdx.json	the Next.js hub, ui/	ui/package-lock.json
neo4j-proxy.cdx.json	the FHIR, OMOP and NLQ bridge	services/neo4j-proxy/package-lock.json
epa-ingest.cdx.json	the ePA ingest CLI and analyte dictionary	services/epa-ingest/package-lock.json
claude-federation.cdx.json	the hosted explanation service (ADR-034)	services/claude-federation/package-lock.json
klarbefund-ios.cdx.json	the iPhone app, clients/ios	Package.swift, project.yml, the imports

The iPhone app declares no third-party package, so its bill lists the Apple frameworks it links (from the import statements, by scripts/security/generate-ios-sbom.py) and says so in its metadata. That is the checkable form of the claim in docs/klarbefund/self-assessment.md (BSI TR-03161 O.TrdP).

Vulnerabilities against these bills: scripts/security/scan-repo.sh runs grype over them locally; .github/workflows/security-scan.yml does the same in CI for the hub and uploads the result to the Security tab. Container images are scanned separately, with trivy, in the same workflow.