Stage349 extends Stage348 by adding a SLSA/SBOM evidence bridge layer.
This stage connects earlier SLSA, SBOM, provenance, policy gate, and Ed25519 review evidence stages to the current REMEDA/QSP evidence binding rail.
Stage237 / Stage238 / Stage239 / Stage240 / Stage273:
SBOM
SLSA provenance
Artifact attestation
Policy gate
Ed25519 review evidence
↓
Stage349:
SLSA/SBOM Evidence Bridge Schema
↓
SHA256 presence check
↓
Provenance presence check
↓
Signature presence check
↓
Policy decision check
↓
fail-closed bridge decision
What Stage349 Adds
SLSA/SBOM evidence bridge schema
SPDX / CycloneDX format acceptance
SLSA provenance metadata acceptance
GitHub artifact attestation metadata acceptance
Ed25519 review evidence metadata acceptance
SHA256 presence check
signature presence check
policy decision check
fail-closed bridge decision
Public Artifacts
docs/schema/slsa_sbom_evidence.schema.json
docs/supply-chain/slsa_sbom_evidence_input.json
docs/supply-chain/slsa_sbom_bridge_result.json
Safety Boundary
Stage349 publishes safe metadata only.
It does not publish:
private keys
raw secrets
production artifacts
exploit code
attack procedures
dangerous payloads
Decision Meaning
pass: SLSA/SBOM evidence metadata satisfies the bridge requirements
fail: schema invalid, signature/provenance/SHA256 missing, unsafe metadata, or unknown decision detected
Stage349 is fail-closed.
Position
Stage348:
Quantum-Safe Evidence Binding Schema Layer
↓
Stage349:
SLSA/SBOM Evidence Bridge Layer
Stage349 connects supply-chain evidence to the REMEDA/QSP evidence verification rail.
License
MIT License
Copyright (c) 2026 Motohiro Suzuki