/claim #14

Summary

• Adds a distinct dependency-advisory-sbom-guard/ slice for issue #14.
• Evaluates hosted scientific code and notebook artifacts before metadata previews, reproduce buttons, scheduled reruns, or export bundles are enabled.
• Matches synthetic SBOM components to local advisory metadata, checks lockfile freshness, runtime/transitive exposure, exploit maturity, fixed versions, and reviewer remediation actions without registry/scanner/network calls.

Non-overlap

This is not another FAIR manifest, artifact access gate, package integrity checker, executable environment drift module, provenance chain, quarantine/rerun module, storage quota ledger, preview cache guard, raw-instrument preview gate, notebook preview checker, retention/tombstone ledger, model-card lineage gate, license compatibility gate, sensitive-file redaction gate, dataset schema evolution gate, data dictionary release gate, or persistent identifier guard. It focuses specifically on dependency advisory and SBOM risk before hosted scientific code or notebooks can execute or export.

Validation

• npm run check
• npm test -> 8 tests passed
• npm run demo -> generated reports/dependency-advisory-packet.json, reports/dependency-advisory-report.md, reports/summary.svg, and reports/demo.mp4
• ffprobe -v error -select_streams v:0 -show_entries stream=codec_name,width,height,duration,avg_frame_rate -show_entries format=size,duration -of default=noprint_wrappers=1 dependency-advisory-sbom-guard/reports/demo.mp4 -> H.264, 1280x720, 4s
• git diff --check and git diff --cached --check
• gitleaks detect --source /home/kali/money/worktrees/scibase-ai --no-git --redact --exit-code 1 -> no leaks

Synthetic data only. No credentials, private artifacts, package registries, vulnerability scanners, external SBOM services, execution sandboxes, live projects, external APIs, or network calls are used by the module.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.