โš™๏ธ Engineering Laboratory โ€ข Digital Evidence โ€ข Cryptographic Trust

BOM Workbench

Understand what you're built from. โœฆ Understand how it's connected. โœฆ Prove what you know.

BOM Workbench is a browser-local engineering environment for creating, exploring, comparing, translating, and cryptographically attesting digital Bills of Materials.

๐Ÿ” Explore What It Does
๐Ÿ“
Source Local Repo & Manifests
โž”
๐Ÿ”
Discover Packages & Imports
โž”
๐Ÿ“‹
BOM Standard Model
โž”
๐ŸŒ
Understand Graph Semantics
โž”
โš–๏ธ
Compare Deterministic Deltas
โž”
๐Ÿ”
Attest ML-DSA-65 & OSCAL
CONFIGURATION FIRST

A BOM is more than a list.

Most tools treat a Bill of Materials as a static flat catalog. BOM Workbench treats it as dynamic system configuration knowledge.

A BOM describes configuration. Components tell us what exists. Relationships tell us how those components form a system. Evidence tells us why we believe the representation. Cryptographic attestation helps us determine whether that evidence has changed.

๐Ÿ“ฆ Components + ๐Ÿ”— Relationships + ๐Ÿงพ Evidence + ๐Ÿ” Provenance = ๐Ÿ’ก Configuration Knowledge
๐Ÿ“ฆ Components

Tell us what exists. Standardized names, versions, package URLs (PURLs), CPEs, declared licenses, and cryptographic checksums.

๐Ÿ”— Relationships

Tell us how components connect to form an operational system. Directed dependencies, hierarchical strata, and containment semantics.

๐Ÿงพ Evidence

Tells us why we believe the representation. Line-numbered manifest entries, lockfile resolutions, and source code import citations.

๐Ÿ” Provenance & Attestation

Helps us determine whether that evidence has changed over time via post-quantum digital signatures and machine-readable OSCAL records.

SPECIFICATION AGNOSTIC

BOM standards are representations.
The configuration is what matters.

Don't let rigid JSON schemas trap your engineering knowledge. BOM Workbench ingests, analyzes, and projects across major industry standards through a normalized internal representation.

CycloneDX 1.7
OWASP / ECMA-424 Current Standard Full support for structured citations, CBOM cryptographic assets, and formulations.
SPDX 2.3
ISO/IEC 5962:2021 Standard Normalized package verification codes, relationships, and license expressions.
SPDX 3.x
SPDX 3.0 Core + Software Modern JSON-LD graph architecture with element identifiers and typed relationships.
Semantics Preservation Principle: Where standards differ, BOM Workbench preserves supported semantics and makes representation differences visible rather than pretending the formats are identical.
CycloneDX 1.7 SPDX 2.3 SPDX 3.x Core BOM WORKBENCH Normalized Model Components & Graph Evidence & Attribution โœ“ Bi-Directional Export
SOURCE TO BOM

Don't have a BOM? Create one.

Point BOM Workbench at a local project folder directly in your browser. The engine extracts components, maps dependencies, captures line citations, and generates valid BOMs locally.

Analyze once. Represent many ways.

No remote server. No uploading code to a third party. BOM Workbench reads files using standard browser File System APIs, parses AST imports, evaluates lockfiles, and discovers package boundaries entirely on your machine.

HTML5 CSS3 JavaScript (ESM / CJS) npm package.json Dart pubspec.yaml Go go.mod Lockfiles SHA-256 Hashes

Engineering Notice: Browser-local source analysis provides deterministic dependency discovery from manifests and code references. It is designed for transparent engineering workflows, not as a replacement for full enterprise build-time binary analysis or dynamic instrumentation.

๐Ÿ“
1. Project Folder Direct browser access to source tree and manifests
โ†“
โš™๏ธ
2. Source Analysis Multi-language parser, SHA-256 hashing, evidence extraction
โ†“
๐Ÿ’ก
3. Configuration Knowledge Linked components, relationship semantics, and unresolved findings
โ†“
๐Ÿ“‹
4. CycloneDX 1.7 / SPDX Export Standards-compliant output with line-numbered proof citations
DEPENDENCY ATTRIBUTION

Why is this component here?

Most SBOM tools record that a dependency exists, but cannot explain why. BOM Workbench exposes four precise relationship semantics with line-level evidence.

DECLARED

Manifest Declaration

The manifest explicitly declares the dependency range (e.g. package.json specifies express: ^4.18).

RESOLVED

Lockfile Resolution

Dependency metadata identifies the exact resolved immutable version selected for build (e.g. package-lock.json specifies express 4.18.2).

REFERENCED

Source Code Reference

Actual application source code imports or invokes the component (e.g. server.js:4 executes require('express')).

OBSERVED SOURCE

Inter-File Citation

One local source artifact directly references or imports another internal file within the repository.

package.json Manifest DECLARES express ^4.18 Declared Constraint RESOLVED EXACT IDENTITY express 4.18.2 pkg:npm/express@4.18.2 REFERENCED server.js:4 require('express')
MULTI-PERSPECTIVE GRAPH

See the configuration from different perspectives.

No single visualization fits every engineering need. BOM Workbench provides four distinct lenses to inspect topology, blast radius, and structure.

App Root Framework A Framework B util-1 util-2 util-3 util-4

Dependency Layers

Understand hierarchy, transitive depth, and topological ordering from root applications down to leaf utilities.

โ˜…

Focus / Neighborhood

Isolate one component and inspect the upstream callers and downstream dependencies that directly matter to it.

@core/* @data/*

Grouped View

Tame massive enterprise graphs by clustering components by package namespace, vendor, or architectural scope.

Physics / Force-Directed

Explore natural clustering, highly connected core hubs, and isolated edge islands using organic spring simulations.

DETERMINISTIC DELTAS

BOM A โ†’ BOM B
What changed?

True configuration drift detection goes far deeper than a diff of component names. BOM Workbench isolates semantic changes across identity, context, and dependencies.

Compare more than component inventories.

Side-by-side matching across baseline and current builds pinpoints exactly what altered across the software supply chain:

โœ“ Components & Types
โœ“ Versions & SemVer Deltas
โœ“ Hashes & Algorithm Proofs
โœ“ Licenses & Expressions
โœ“ Suppliers & Authors
โœ“ Topological Relationships

โ€œA component may not have changed. Its configuration context may have.โ€
Trust requires lineage, not just integrity.

Baseline Release A Current Release B
Node A Node B Node C Node A Node D (+) Node C Removed (B) Added (D)
POST-QUANTUM TRUST

BOMs may live longer than today's cryptography.

Bills of Materials for aerospace, defense, energy, and medical infrastructure must remain verifiable for 20 to 50 years. Classical RSA and ECDSA signatures will not survive that horizon.

Browser-Local ML-DSA-65 Cryptographic Signing

BOM Workbench demonstrates client-side quantum-resilient signatures using FIPS 204 ML-DSA-65 (Module-Lattice-Based Digital Signature Algorithm), producing verifiable assessment evidence entirely in the browser.

BOM Canonical JSON Deterministic Order SHA-256 Payload Digest ML-DSA-65 FIPS 204 Lattice VERIFY Assessment Evidence
1. Document BOM (.json) The evaluated CycloneDX or SPDX bill of materials in deterministic normalized form.
2. signature.json Detached FIPS 204 signature containing public key, payload hash, and lattice-based signature bytes.
3. oscal.assessment-results.json Machine-readable NIST OSCAL assessment results detailing exact cryptographic checks and findings.
Demonstration Notice: The Workbench can create and verify an ML-DSA-65 signature, demonstrate tamper detection, and produce assessment evidence describing what was verified. The current browser implementation utilizes ephemeral signing keys for demonstration and assessment workflow, without asserting hardware-backed organizational identity.
ZERO CLOUD DEPENDENCIES

Your BOM. Your source. Your machine.

BOM Workbench is designed to perform its analysis locally in the browser. Your project does not need to be uploaded to a BOM Workbench server simply to explore or create a BOM.

No tracking scripts, no third-party telemetry, no cloud backend required. Run it directly from a static host or your local filesystem.

๐Ÿ’ป
YOUR MACHINE
BOM Workbench: Source โ†’ BOM โ†’ Evidence
โœ• No Cloud Upload
PRODUCT BOUNDARIES

What BOM Workbench Is โ€” and Isn't

Clear boundaries make better engineering tools. Here is how BOM Workbench fits into your toolchain.

BOM Workbench Is
  • โœ“ Browser-local engineering environment: Create, inspect, edit, validate, and compare BOMs client-side.
  • โœ“ Multi-standard translation: Understand and project across CycloneDX 1.7, SPDX 2.3, and SPDX 3.0.
  • โœ“ Dependency attribution: Expose why components exist using declared, resolved, referenced, and observed semantics.
  • โœ“ Post-quantum assurance: Demonstrate browser-local ML-DSA-65 signing and NIST OSCAL assessment results.
BOM Workbench Is Not
  • โœ• Vulnerability-management platform: We do not replace CVE scoring, triage dashboards, or advisory feeds.
  • โœ• Enterprise SBOM repository: We do not provide centralized cloud storage or tenant-level fleet management.
  • โœ• Commercial SCA service: We do not crawl proprietary closed databases or perform remote binary decompilation.
  • โœ• Build or runtime monitor: We do not replace compiler instrumentations, eBPF probes, or live agent telemetry.
ORGANIZATIONAL STEWARDSHIP

Built by people who care about configuration.

BOM Workbench is part of the work being developed through Meta-Governance and i-infusion.

We are exploring how Configuration Management, digital evidence, provenance, and post-quantum cryptography can help organizations understand and trust increasingly complex digital systems.

๐ŸŒ i-infusion.com ๐Ÿ›๏ธ Meta-Governance.com
GET IN TOUCH

Let's talk BOMs.

Have questions about configuration management, post-quantum attestation, or integrating BOM Workbench into your workflow?

โœ‰๏ธ sales@i-infusion.com
๐Ÿ›๏ธ Meta-Governance.com ๐ŸŒ i-infusion.com
Direct inquiries for partnerships, federal advisory, and technical evaluations are welcomed.

Don't just inventory the configuration.
Understand it.

Create โ€ข Explore โ€ข Compare โ€ข Translate โ€ข Attest

BOM Workbench โ€” Developed through Meta-Governance & i-infusion.

OWASP CycloneDX 1.7 (ECMA-424) โ€ข SPDX 2.3 & 3.0 โ€ข FIPS 204 ML-DSA-65 โ€ข NIST OSCAL โ€ข 100% Client-Side