ONB-16 · Tramiton evidence reconciliation (detect handoff + local evidence + entitlement) #135

New Issue

2026-07-10T10:32:30Z

sharang commented

2026-07-10 10:32:30 +00:00

Part of #118. Suite-integration workstream. compliance-scanner and tramiton are the same company — onboarding must reconcile tramiton's authoritative firmware evidence, not recompute it.

Context

tramiton already does firmware build detection, SBOM (CycloneDX/SPDX), VEX (OpenVEX), reproducible builds, and attestation. When a tenant who owns tramiton onboards a firmware/Yocto target here, we should fetch/reuse tramiton's evidence.

Integration facts (verified against `/home/sharang/workspace/tramiton`, v0.4.0)

Mechanism: shell out to the tramiton CLI (crates are license = "Proprietary"; mirror the JSON, don't link). tramiton detect --json <path> → {repo, detections, plan:BuildPlan} with typed target{board,mcu,arch}, build_system, framework, confidence, gaps.
Reconciliation key: tramiton project_id (shared cross-product key) + firmware SHA-256 = compliance-scanner's Artifact.content_hash. Ingest hashing is the join key.
Cloud read-back does NOT exist yet — tramiton cloud only stores SBOMs (write-only). Near-term reconciliation reads local .tramiton/ outputs (tramiton.lock TOML, sbom.cdx.json, vex.openvex.json, DSSE attestation). Cloud fetch needs tramiton to add read endpoints later.
Entitlement: offline-verifiable Ed25519 LicenseGrant {project, subscription, expires} (packaged as ProjectBundle). Map tramiton tenant_id → our tenant.
Formats already match (CycloneDX 1.5, OpenVEX 0.2.0) — reconciled evidence flows in shapes we handle.

Scope

Seam now: EvidenceProvider port in compliance-core + a TramitonCli impl (detect handoff + local .tramiton/ reader) + a deterministic mock for tests. ExternalRef/ExternalProvenance on the target model (system=tramiton, project_id, subject_sha256, status, license_grant?).
Firmware/Yocto scans prefer reconciled tramiton evidence when the artifact hash matches; else recompute.
Later: cloud fetch once tramiton adds read endpoints; LicenseGrant verification for entitlement (needs shared pinned pubkey).

Depends on

ONB-01 (#119), ONB-02 (#120), ONB-03 (#121). Firmware specifics (#128).

Part of #118. **Suite-integration workstream.** compliance-scanner and tramiton are the same company — onboarding must reconcile tramiton's authoritative firmware evidence, not recompute it. ## Context tramiton already does firmware build detection, SBOM (CycloneDX/SPDX), VEX (OpenVEX), reproducible builds, and attestation. When a tenant who owns tramiton onboards a firmware/Yocto target here, we should fetch/reuse tramiton's evidence. ## Integration facts (verified against `/home/sharang/workspace/tramiton`, v0.4.0) - **Mechanism:** shell out to the `tramiton` CLI (crates are `license = "Proprietary"`; mirror the JSON, don't link). `tramiton detect --json <path>` → `{repo, detections, plan:BuildPlan}` with typed `target{board,mcu,arch}`, `build_system`, `framework`, `confidence`, `gaps`. - **Reconciliation key:** tramiton `project_id` (shared cross-product key) + firmware **SHA-256** = compliance-scanner's `Artifact.content_hash`. Ingest hashing is the join key. - **Cloud read-back does NOT exist yet** — tramiton cloud only *stores* SBOMs (write-only). Near-term reconciliation reads local `.tramiton/` outputs (`tramiton.lock` TOML, `sbom.cdx.json`, `vex.openvex.json`, DSSE attestation). Cloud fetch needs tramiton to add read endpoints later. - **Entitlement:** offline-verifiable Ed25519 `LicenseGrant {project, subscription, expires}` (packaged as `ProjectBundle`). Map tramiton `tenant_id` → our tenant. - **Formats already match** (CycloneDX 1.5, OpenVEX 0.2.0) — reconciled evidence flows in shapes we handle. ## Scope - Seam now: `EvidenceProvider` port in compliance-core + a `TramitonCli` impl (detect handoff + local `.tramiton/` reader) + a deterministic mock for tests. `ExternalRef`/`ExternalProvenance` on the target model (system=tramiton, project_id, subject_sha256, status, license_grant?). - Firmware/Yocto scans prefer reconciled tramiton evidence when the artifact hash matches; else recompute. - Later: cloud fetch once tramiton adds read endpoints; `LicenseGrant` verification for entitlement (needs shared pinned pubkey). ## Depends on ONB-01 (#119), ONB-02 (#120), ONB-03 (#121). Firmware specifics (#128).

sharang added this to the Onboarding v1 milestone 2026-07-10 10:32:30 +00:00

sharang added the onboarding enhancement labels 2026-07-10 10:32:30 +00:00

sharang referenced this issue

2026-07-10 10:33:12 +00:00

ONB-Epic · Multi-target artifact-aware onboarding wizard #118

sharang referenced this issue from a commit

2026-07-10 10:52:44 +00:00

feat(onboarding): artifact ingest + classifier + suite-integration seams

sharang referenced this issue

2026-07-10 10:53:11 +00:00

feat(onboarding): artifact ingest + classifier + suite-integration seams #138

sharang referenced this issue from a commit