sbom-fidelity-loop

Run cdxgen with --introspect or --profile introspect to generate a fidelity report, then execute the top-ranked remediation's actions and re-scan. Repeat until every ecosystem reaches resolved, lockfile, or at-ceiling state, verifying each fix by the next report's verify clause.

The introspection report is a JSON document grading each scanned ecosystem on a tier ladder from resolved down to absent, with a 0-100 score and ranked remediations. The remediation array is ordered by expected gain, so remediation[0] is the next candidate to execute.

Both produce the same fidelity report. Prefer --introspect when the project's language does not support evidence collection or when the profile's extra passes add noise the loop does not need.

No. The loop never modifies the project, since adding a lockfile the project does not carry falsifies the SBOM's subject. Config-type remediations are surfaced to the human as advice instead of being executed.

A stall means a re-run with the same inputsFingerprint did not raise the score, so the applied fix did not change the inputs. The loop reports the attempted remediation id and stops rather than retrying failed or no-change outcomes at the same fingerprint.

Blocked entries cannot run in the current environment due to secure mode, command allowlists, offline network, dry-run, or already running inside a container. They are information for the human; the loop stops and reports blocked rather than improvising workarounds.