@algora-pbc /claim #17

Summary

• adds a dependency-free software dependency provenance graph guard for SCIBASE issue #17
• evaluates notebook/code dependency graph edges for lockfile/runtime parity, SBOM evidence, container digest pinning, license/access safety, deprecation, and high-risk advisories
• emits project decisions, dependency edge statuses, recommendation suppression/hold decisions, deterministic findings, audit digest, and reviewer artifacts

Scope

This is a distinct Knowledge Graph Integration slice focused only on scientific software dependency provenance before entity pages or recommendations publish. It avoids the existing broad extractor/navigation, ontology drift, multilingual alias, geospatial sample, organism/strain, funding-award, image metadata, temporal consistency, and general evidence-freshness slices. Synthetic data only; no credentials, package registry calls, private repositories, or external services.

Validation

• npm run check
• npm test
• npm run demo
• git diff --check
• ffprobe -v error -select_streams v:0 -show_entries stream=codec_name,width,height,duration -of default=noprint_wrappers=1 software-dependency-provenance-graph-guard/reports/demo.mp4

Demo MP4 verification: H.264, 1280x720, 6.0 seconds.

AI-assisted with OpenAI Codex; I reviewed and verified the diff and generated artifacts before submitting.