<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Supply Chain Security Architecture — API Reference

## agent.js CLI

```bash
# Generate SBOM from manifest
node scripts/agent.js --action sbom --manifest package.json --output sbom.json

# Assess dependencies against policy
node scripts/agent.js --action assess --sbom sbom.json --policy policy.json

# Evaluate SLSA compliance level
node scripts/agent.js --action slsa --pipeline pipeline.json --output slsa-report.json

# Validate supply chain integrity
node scripts/agent.js --action validate --sbom sbom.json --provenance provenance.json
```

## Pipeline Config JSON Schema

```json
{
  "name": "github-actions-main",
  "features": [
    "build-process-documented",
    "provenance-generated",
    "hosted-build",
    "signed-provenance",
    "build-service"
  ]
}
```

## SLSA Levels

| Level | Key Requirements |
|-------|-----------------|
| 1 | Build documented, provenance exists |
| 2 | Hosted build, signed provenance |
| 3 | Hardened build, non-falsifiable provenance |
| 4 | Two-party review, hermetic & reproducible builds |

## Dependency Policy JSON Schema

```json
{
  "max_critical_vulns": 0,
  "max_high_vulns": 3,
  "blocked_licenses": ["AGPL-3.0", "GPL-3.0"],
  "require_pinned_versions": true,
  "max_dependency_age_days": 365
}
```

## Tooling Integration

- **SBOM**: syft, trivy, cyclonedx-cli
- **Signing**: cosign (Sigstore), in-toto
- **Scanning**: grype, snyk, dependabot
- **Provenance**: SLSA GitHub generator
