{
  "schema_version": "1.0",
  "receipt_id": "par_sbom_release_2026_09_16",
  "need": "Publish a verifiable GitHub release whose artifacts, dependencies, checksums, and provenance match the built wheel.",
  "artifact_role": "sbom_and_release_chain",
  "discovery": {"queries": ["CycloneDX Python environment SBOM", "Syft Python environment SBOM", "GitHub artifact attestation", "third-party release service"], "stop_condition": "Two established SBOM contenders and the native host release/provenance path identified."},
  "contenders": [
    {"name": "CycloneDX Python", "disposition": "adopt", "evidence": ["7.4.0", "Apache-2.0", "clean wheel environment: root plus 14 dependency components covered all 15 installed distributions", "15 dependency graph nodes", "reproducible mode emitted no timestamp, random serial, or environment path"]},
    {"name": "Syft", "disposition": "reject", "evidence": ["1.51.1", "Apache-2.0", "default scan emitted 48 components including 33 file records and 34 temporary-environment path references", "Python-only scan with file catalogers disabled covered 15 distributions but duplicated the root, emitted only 7 dependency nodes, typed the root as file, and retained a random serial and timestamp"]},
    {"name": "GitHub release + artifact attestation", "disposition": "adopt", "evidence": ["native repository boundary", "no second credential or service"]},
    {"name": "extra release/signing service", "disposition": "reject", "evidence": ["no surviving gap before the native path is measured"]}
  ],
  "hard_gates": ["clean environment containing built wheel", "inspect dependency set", "SHA256SUMS", "annotated tag", "attestation verified", "no PyPI publication"],
  "unknowns": ["GitHub-hosted artifact attestation remains unverified until the annotated tag triggers the release workflow."],
  "decision_effect": "Generate one reproducible CycloneDX 1.6 SBOM from the clean installed wheel environment; keep Syft out of the release chain; release only through GitHub.",
  "reconsider_when": ["Native attestation is unavailable", "Neither SBOM describes the clean wheel environment accurately"],
  "observed_at": "2026-09-17T04:42:00Z"
}