Review decisions, approvals and the release gate

Record named human decisions and approvals; apply a gate. This page documents every command in the reviewing group, in the order sbomflow help reviewing lists them. Each command's section is generated from the command itself — its summary, description and options from the parser, and its reads, writes, exit codes, examples and see-also from the command catalog — so it says exactly what sbomflow <command> --help says. Every example below is executed offline by the test suite, and every non-zero exit code is either produced by an executed probe or carries a recorded reason why no offline probe can produce it.

See the CLI overview for how the thirteen groups fit together and the command reference for every command's options in one place.

Overview#

sbomflow review <output> — record human review decisions. reviews.json and vulnerability_reviews.json are one decision family and share a key space, so they are read together: a key the two files answer differently is reported as contested, and neither answer is applied. The finding stays on the worklist, review-queue.json carries the count in decision_intake, and the terminal says how many keys were declined. SBOMFlow never picks between two recorded human decisions. Every other key in the same files keeps applying, and files that agree change nothing.
sbomflow review-view <output> — render the reviewer console. It reads the two decision files through the same intake, so a contested key is declined there too and review, review-view and next-actions report one number for one directory.
sbomflow approve — record and show named release approvals; sbomflow gate, sbomflow policy and sbomflow decisions inspect the gate and the decision records without writing any.

Who this is for: reviewers, release managers, reviewer pairs, CI owners, policy authors and operators.

`sbomflow review`#

Show the review queue, or record one human sign-off decision with an audit event.

text

Show what still needs a human decision, or record exactly one decision.
It records YOUR decision - it never decides.

review-queue.json is rewritten only when its content changed, so reading
the queue never invalidates a bundle sealed before it. A decision appends
to reviews.json / vulnerability_reviews.json / waivers.json plus a
hash-chained audit event, and then says to rebuild the bundle. A refused
decision (not_affected without a valid CISA justification, say) exits 2
and records nothing.

With no decision flags this is read-only apart from review-queue.json.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	an existing analyze or audit output directory.
Writes	a decision appends to reviews.json, vulnerability_reviews.json or waivers.json; review-queue.json, only when its content changed; stdout (the review queue; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` usage error or a refused decision
Machine output	has-json — shows the review queue, or records one decision and then shows the refreshed queue; one versioned JSON document on stdout, and a recording action's receipt goes to stderr

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`[EVIDENCE_DIR]`	`[EVIDENCE_DIR]`	none	any	no	Directory produced by 'analyze'/'audit' (omit only with --template).
`--template`	`CISA_JUSTIFICATION`	none	component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary, inline_mitigations_already_exist	no	Print a starting justification scaffold for the given CISA category and exit (you edit it into a real explanation; it is never submitted). One of: component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary, inline_mitigations_already_exist.
`--reviews`	`REVIEWS`	none	any	no	Evidence reviews file to read/update (default: <output>/reviews.json).
`--vulnerability-reviews`	`VULNERABILITY_REVIEWS`	none	any	no	Vulnerability VEX-triage file to read/update (default: <output>/vulnerability_reviews.json).
`--accept`	`KEY`	none	any	no	Accept the evidence item with this key, or the preserved artifact whose review key (preserved-artifact:sha256:<hex>, listed in preserved-artifacts.json) this is; a preserved-artifact decision requires --reviewer and --note.
`--reject`	`KEY`	none	any	no	Reject the evidence item or preserved artifact KEY.
`--needs-more-evidence`	`KEY`	none	any	no	Mark the evidence item or preserved artifact with this key as needing more evidence.
`--triage`	`VULN_ID`	none	any	no	Record a VEX triage decision for this vulnerability id (with --status).
`--status`	`STATUS`	none	affected, fixed, not_affected, under_investigation	no	VEX status for --triage. One of: affected, fixed, not_affected, under_investigation.
`--justification`	`JUSTIFICATION`	none	any	no	CISA justification (required when --status not_affected).
`--evidence-ref`	`EVIDENCE_REF`	none	any	no	Optional evidence reference for a VEX triage.
`--waive-gap`	`GAP_ID`	none	any	no	Record a time-boxed waiver for this gap id (requires --reason and --expires-at).
`--waive-finding`	`VULN_ID`	none	any	no	Record a time-boxed waiver for this finding id (requires --reason and --expires-at).
`--renew-waiver-gap`	`GAP_ID`	none	any	no	Renew the existing waiver for this gap id with a fresh --reason and a later --expires-at (the reason must differ from the one it renews).
`--renew-waiver-finding`	`VULN_ID`	none	any	no	Renew the existing waiver for this finding id with a fresh --reason and a later --expires-at (the reason must differ from the one it renews).
`--revoke-waiver-gap`	`GAP_ID`	none	any	no	Revoke the existing waiver for this gap id (requires --reason and --reviewer). The record stays in waivers.json marked revoked — history preserved — and immediately stops applying; a revoked waiver cannot be renewed (record a fresh waiver instead).
`--revoke-waiver-finding`	`VULN_ID`	none	any	no	Revoke the existing waiver for this finding id (requires --reason and --reviewer). The record stays in waivers.json marked revoked — history preserved — and immediately stops applying; a revoked waiver cannot be renewed (record a fresh waiver instead).
`--dispute-match`	`FINDING_KEY`	none	any	no	Dispute the advisory match itself for this finding_key (requires --reason and --reviewer: a dispute suppresses a blocking finding, so it must name the human who asserted the match is wrong). Distinct from VEX: excludes the finding from vex.json/cyclonedx-vex.json/csaf-vex.json entirely, labels it (never excludes it) in cyclonedx-vdr.json, and suppresses it from the gate under its own disputed_matches list; reappears automatically if the match evidence (aliases/range/purl) changes on a later run.
`--reason`	`REASON`	none	any	no	Mandatory reason recorded with a waiver, a waiver revocation, or a match dispute.
`--expires-at`	`EXPIRES_AT`	none	any	no	Mandatory ISO expiry recorded with a waiver.
`--start`	`KEY`	none	any	no	Claim an evidence key, vulnerability id, or gap id: moves it to 'in_review' so two reviewers don't silently duplicate work (requires --as ROLE). A claim carries no evidence authority — it never accepts evidence or sets a status.
`--as`	`ROLE`	none	any	no	Reviewer role claiming the item with --start.
`--force`	(flag)	false	—	no	With --start: reclaim an item already claimed by someone else (the prior claim stays in the audit log).
`--bulk`	`FILE`	none	any	no	Record many VEX triage decisions from a pre-reviewed .csv or .json worksheet (columns/keys: finding_key, status, justification, reviewer, note, evidence_ref — finding_key is the vulnerability id, same as --triage). Each row is validated and recorded independently with its own audit event; invalid rows are listed and skipped, valid rows still apply. There is no 'accept all' — every row states its own status and justification.
`--reviewer`	`REVIEWER`	none	any	no	Reviewer identity recorded with the decision.
`--note`	`NOTE`	none	any	no	Reviewer note recorded with the decision (required, with --reviewer, for a preserved-artifact key: the conclusion and its limits).
`--reviewed-at`	`REVIEWED_AT`	none	any	no	ISO timestamp for the decision (default: now/--as-of).
`--idempotency-key`	`KEY`	none	any	no	Optional stable key so a retried vulnerability triage converges to ONE operation instead of recording a second one. Same key + same decision returns the existing operation; same key + a different decision is refused. 1-128 chars [A-Za-z0-9._-]. SCOPE: convergence is per OUTPUT DIRECTORY — the same key used against a different output dir is a separate operation, not a retry.
`--assign`	`ROLE`	none	any	no	Annotate the queue with an assigned reviewer role.
`--as-of`	`AS_OF`	none	any	no	Pinned timestamp for the queue / audit event.
`--filter`	`EXPR\|@name`	none	any	no	Narrow the queue view with comma-joined FIELD OP VALUE terms (severity/epss/kev/status/ssvc/kind/assigned/component), e.g. 'severity>=high,kev=true'; or @name for a filter saved under review.filters in sbomflow.yaml. A filter narrows what you look at — it never changes a decision, a status, or the gate.
`--store`	`DIR`	none	any	no	Local evidence store to read prior reviewer decisions from (offline). Surfaces this product's earlier per-finding decisions as review context; it never suppresses a finding or changes VEX status.
`--json`	(flag)	false	—	no	Emit the review queue as JSON.
`--digest`	(flag)	false	—	no	Print a session digest of decisions recorded in this audit log (accepted/rejected/needs-more-evidence, findings triaged, waivers, approvals), grouped with event-hash references, and write session-digest.md. Read-only; records nothing.
`--since`	`SINCE`	none	any	no	With --digest: only include decisions recorded at or after this ISO-8601 timestamp.

Examples

Print the human review queue for a finished run.

sbomflow review out

Accept one evidence item, naming who decided and why.

sbomflow review out --accept vulnerability_disclosure_policy --reviewer you@example.com --note 'Mailbox monitored.'

Record a VEX triage: not affected, with its CISA justification.

sbomflow review out --triage CVE-SAMPLE-OPENSSL-001 --status not_affected --justification vulnerable_code_not_in_execute_path --reviewer you@example.com --note 'Not reachable.'

Accept a preserved trace by its review key, in a run whose sbomflow.yaml declared it under preserved_artifacts: (here sbomflow analyze sensor-node --output sensor-evidence); a preserved-artifact decision needs --reviewer and --note.

sbomflow review sensor-evidence --accept preserved-artifact:sha256:c640b55149337567f8395db0fd66102ecb98006a9762a67cbf62114a6932d7a2 --reviewer lab-lead --note 'Trace covers boot to idle; no fault path exercised.'

Waive one evidence gap until a stated date, with the reason.

sbomflow review out --waive-gap GAP-CRA-A1-P1-2m-secure_data_erasure --reason 'Erasure test scheduled.' --expires-at 2999-12-31T23:59:59Z --reviewer you@example.com

Refuse not_affected without a CISA justification; nothing is recorded. Exits 2.

sbomflow review out --triage CVE-SAMPLE-OPENSSL-001 --status not_affected --reviewer you@example.com

See what still needs a human decision in the pack sbomflow audit . --output evidence wrote.

sbomflow review ./evidence

See also: sbomflow approve, sbomflow review-view, sbomflow explain, sbomflow help reviewing, sbomflow help goal sign-off.

`sbomflow review-view`#

Write reviewer.html: queue, findings, requirement coverage, gate and approvals for an output dir.

text

Render one static HTML file a reviewer opens locally: the review queue,
evidence, findings, requirement coverage, the gate, approvals and the
audit trail, composed from the artifacts already in the directory.
Read-only apart from the file it writes; no server, no JavaScript, no
network.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	an existing analyze or audit output directory.
Writes	reviewer.html, a local console composed from the pack
`--output` names	one file
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` missing or unusable directory
Machine output	artifact-suffices — writes `reviewer.html`, a human console composed from artifacts that are already machine-readable

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--report-theme`	`{light,dark}`	light	light, dark	no	Palette for generated HTML surfaces (default: light). Print output is always light.
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	Directory produced by 'analyze'/'audit'.
`--output`	`OUTPUT`	none	any	no	Where the HTML is written (file). Default: <output_dir>/reviewer.html.

Examples

Write the reviewer console beside the pack.

sbomflow review-view out

Write it to a named file, in the dark palette.

sbomflow review-view out --output reviewer.html --report-theme dark

Refuse a directory that does not exist. Exits 2.

sbomflow review-view missing-dir

See also: sbomflow review, sbomflow dashboard, sbomflow bundle.

`sbomflow review-merge`#

Merge two reviewer decision files by key, reporting conflicts (offline).

text

Combine two reviewers' decision files (or a laptop copy and the CI copy)
safely. Merging is by decision KEY, never by line: keys on one side are
unioned in, identical decisions deduplicate, and a key whose decision
DIFFERS is never auto-resolved.

A conflicting key is written to merge-conflicts.json, omitted from the
merged file, and the command exits 1 until a human passes --resolve.
With --base, the side that changed relative to the base wins over the
side that did not (deletions included). Any parse failure or a
cross-product merge aborts entirely; there are no partial merges.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	two reviewer decision files and, for a three-way merge, their common base.
Writes	the merged decision file at --output; merge-conflicts.json when a key conflicts
`--output` names	one file
Network	offline — This command has no network-capable path.
Exit codes	`0` merged with no conflict · `1` a key carries conflicting decisions · `2` input or usage error
Machine output	artifact-suffices — writes the merged reviewer decision file plus a conflict report

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--ours`	`OURS`	none	any	yes	Your decision file.
`--theirs`	`THEIRS`	none	any	yes	The other decision file.
`--base`	`BASE`	none	any	no	Common ancestor for a three-way merge.
`--output`	`OUTPUT`	none	any	yes	Where the merged decision document is written (file).
`--as-of`	`AS_OF`	none	any	no	Pinned timestamp for a byte-reproducible merge.
`--resolve`	`KEY=ours\|theirs`	none	any	no	Resolve one conflicting key to a side. Repeatable.

Examples

Three-way merge: the side that changed relative to the base wins.

sbomflow review-merge --ours reviews/ours.json --theirs reviews/theirs.json --base reviews/base.json --output merged.json

Two-way merge: a key both sides decided differently is omitted and exits 1. Exits 1.

sbomflow review-merge --ours reviews/ours.json --theirs reviews/theirs.json --output merged.json

Resolve that conflicting key to one side explicitly.

sbomflow review-merge --ours reviews/ours.json --theirs reviews/theirs.json --output merged.json --resolve update_mechanism_documented=theirs

See also: sbomflow review, sbomflow approve, sbomflow decisions.

`sbomflow approve`#

Show release-approval status, or record one approval, revocation or override.

text

Show multi-role release-approval status, or record one sign-off action.
Status display alone writes nothing; an action writes approvals.json plus
a hash-chained audit event. Separation of duties is enforced: an approver
may not be the declared release author, and one reviewer may not cover
two required roles; a refused action exits 2.

SBOMFlow records the sign-off; it never grants an approval itself. An
override lets the gate proceed but never hides the missing roles.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	an existing analyze or audit output directory.
Writes	approvals.json and an audit event, when an action is recorded; approvals-audit-export.* with --export-audit; stdout (the approval status; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` usage error or a refused action
Machine output	has-json — shows the approval status, or records one approval action and then shows it; the status is one versioned JSON document on stdout and a recording action's receipt goes to stderr

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	Directory produced by 'analyze'/'audit'.
`--approvals`	`APPROVALS`	none	any	no	Approval ledger to read/update (default: <output>/approvals.json).
`--require-role`	`ROLE`	none	any	no	Required role(s) for the status display (repeatable). Also the set the separation-of-duties rule reads: 'two required roles' means two of these, so without --require-role or --policy no role is required and an approver covering a second role is neither refused nor reported.
`--policy`	`POLICY`	none	any	no	Policy profile supplying required_approval_roles for the status display.
`--role`	`ROLE`	none	any	no	Role to approve, or to revoke with --revoke.
`--revoke`	(flag)	false	—	no	Revoke the active approval for --role.
`--override`	(flag)	false	—	no	Record an emergency override of missing approvals (requires --reason).
`--reviewer`	`REVIEWER`	none	any	no	Reviewer identity recorded with the action. MANDATORY when approving a role and when recording --override: an unattributed approval satisfies no role, and an unattributed override suppresses nothing. Optional only for --revoke, which withdraws authority and so fails closed.
`--author`	`AUTHOR`	none	any	no	Declared release author (separation of duties: an approver may not be the author).
`--delegate-of`	`REVIEWER`	none	any	no	Record this approval as a delegate standing in for REVIEWER (e.g. a release manager on leave). Requires --expires-at (delegation is always time-boxed); delegating for someone who is themselves currently delegating is refused (one hop only).
`--expires-at`	`EXPIRES_AT`	none	any	no	ISO expiry. Optional for an approval; MANDATORY for --override and with --delegate-of.
`--reason`	`REASON`	none	any	no	Reason for a revocation, or the mandatory override reason.
`--note`	`NOTE`	none	any	no	Optional note recorded with an approval.
`--idempotency-key`	`KEY`	none	any	no	Optional stable key so a retried approval or revocation converges to ONE operation instead of recording a second. Same key + same action returns the existing operation; same key + a different action is refused. 1-128 chars [A-Za-z0-9._-]. SCOPE: convergence is per OUTPUT DIRECTORY — the same key used against a different output dir is a separate operation, not a retry.
`--as-of`	`AS_OF`	none	any	no	Pinned timestamp for the status / audit event.
`--json`	(flag)	false	—	no	Emit the approval status as JSON.
`--export-audit`	`DIR`	none	any	no	Export the approvals ledger for an auditor to DIR/approvals-audit-export.* instead of showing or recording status (refuses on a tampered audit chain).
`--format`	`{csv,json}`	csv	csv, json	no	Format for --export-audit (default: csv).
`--share-profile`	`{importer,distributor,customer}`	none	importer, distributor, customer	no	Redaction profile for --export-audit (redacts reviewer identity and reason text).

Examples

Show which required roles have signed off.

sbomflow approve out --require-role product-security

Record one named approval for a role.

sbomflow approve out --role product-security --reviewer sec@example.com

Export the approvals ledger for an auditor.

sbomflow approve out --export-audit audit-export

Refuse an approver who is also the declared release author. Exits 2.

sbomflow approve out --role product-security --reviewer sec@example.com --author sec@example.com

See also: sbomflow review, sbomflow audit, sbomflow gate simulate, sbomflow help goal sign-off.

`sbomflow decisions`#

Inspect and recover crash-interrupted human decision transactions (offline).

text

A human decision (a triage, a waiver, an approval) is written as a
transaction: a journal first, then the decision file, then its audit event.
These verbs list those journals, verify them against the decision files and
the audit log, recover one an interruption left unfinished, or quarantine one
that can no longer be read. Name a verb, or the group prints its usage and
exits 2.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	nothing itself; its verbs read one output directory's decision journals.
Writes	nothing itself; each verb's help names what it writes
Network	offline — This command has no network-capable path.
Exit codes	`0` a verb ran and returned 0 · `2` no verb given, or the verb refused
Machine output	human-only-by-design — group dispatcher: prints usage/guidance only; the machine surfaces are its nested verbs

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit

Examples

List the unfinished decision journals of one output directory.

sbomflow decisions transactions --store out

Report what recovering an interrupted decision would do, writing nothing.

sbomflow decisions recover --store interrupted-evidence --operation-id e70264376828e45e18f4036bdc5a644f --dry-run

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow decisions

See also: sbomflow decisions transactions, sbomflow decisions recover, sbomflow review.

`sbomflow decisions quarantine`#

Move ONE unreadable decision journal aside as an audited event.

text

Move one unreadable decision-transaction journal under
.decision-txn/quarantine/ as an AUDITED event: the copy, its digest and
the parse failure are appended to the audit log before the original is
unlinked. It is never a delete, and a journal that can still be
recovered is refused: use `sbomflow decisions recover` for that. No
unreadable journal by that id, or no audit log to record it in, exits 4.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	one output directory's decision journals and its audit log.
Writes	moves the journal under .decision-txn/quarantine/; an audit event naming who discarded it; stdout (the result; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` no store at --store, or the quarantine was refused · `4` no unreadable journal by that id, or no audit log to record it in
Machine output	has-json — moves an unreadable decision journal under quarantine as an AUDITED event — the copy, its digest and the parse failure are appended before the original is unlinked, so an un-audited quarantine is unreachable; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--store`	`STORE`	none	any	yes	OUTPUT_DIR - the analyze/audit output directory (not the evidence store).
`--operation-id`	`OPERATION_ID`	none	any	yes	The operation id whose journal to quarantine.
`--reviewer`	`REVIEWER`	none	any	yes	Who is discarding this journal. Required: the audit chain must name them.
`--reason`	`REASON`	none	any	no	Optional free-text note recorded with the quarantine event.
`--as-of`	`AS_OF`	none	any	no	Pin the quarantine event's timestamp (ISO-8601; default: now).
`--json`	(flag)	false	—	no	Emit deterministic JSON.

Examples

Quarantine one unreadable journal as an audited event.

sbomflow decisions quarantine --store journal-evidence --operation-id 0123456789abcdef0123456789abcdef --reviewer you@example.com --reason 'Unreadable after a disk fault.' --as-of 2026-06-21T12:00:00+00:00

The same, reporting the result as JSON.

sbomflow decisions quarantine --store journal-evidence --operation-id 0123456789abcdef0123456789abcdef --reviewer you@example.com --json

Refuse when the directory holds no unreadable journal by that id. Exits 4.

sbomflow decisions quarantine --store out --operation-id 0123456789abcdef0123456789abcdef --reviewer you@example.com

See also: sbomflow decisions transactions, sbomflow decisions verify-transactions, sbomflow decisions recover.

`sbomflow decisions recover`#

Recover ONE interrupted decision transaction by operation id.

text

Finish one decision an interruption left between its decision write and its
audit event: the missing audit event is appended exactly once, marked
recovered, and reconstructed from the decision that landed. --dry-run reports
what would happen and writes nothing. No interrupted journal for that
operation id exits 4.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	one output directory's decision journals, decision files and audit log.
Writes	the missing audit event for the interrupted decision; stdout (what was, or would be, done; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` no store at --store, or the recovery was refused · `4` no interrupted journal for that operation id
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--store`	`STORE`	none	any	yes	OUTPUT_DIR - the analyze/audit output directory (not the evidence store).
`--operation-id`	`OPERATION_ID`	none	any	yes	The operation id to recover.
`--dry-run`	(flag)	false	—	no	Report the action that would be taken; write nothing.
`--json`	(flag)	false	—	no	Emit deterministic JSON.

Examples

Report what recovery would do, writing nothing.

sbomflow decisions recover --store interrupted-evidence --operation-id e70264376828e45e18f4036bdc5a644f --dry-run

Recover the interrupted decision: its missing audit event is appended once.

sbomflow decisions recover --store interrupted-evidence --operation-id e70264376828e45e18f4036bdc5a644f

Report the recovery as JSON.

sbomflow decisions recover --store interrupted-evidence --operation-id e70264376828e45e18f4036bdc5a644f --json

See also: sbomflow decisions transactions, sbomflow decisions verify-transactions, sbomflow decisions quarantine.

`sbomflow decisions transactions`#

List decision-transaction journals in a store.

text

List the decision-transaction journals one output directory holds, with each
one's classification. A completed transaction's journal is removed once its
audit event is written, so an empty list means no operation is still waiting.
Read-only.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	one output directory's decision journals.
Writes	stdout (one row per journal; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` missing or unusable directory
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--store`	`STORE`	none	any	yes	OUTPUT_DIR - the analyze/audit output directory (not the evidence store).
`--json`	(flag)	false	—	no	Emit deterministic JSON.
`--limit`	`LIMIT`	1000	any	no	Maximum journals to report (bounded).
`--operation-type`	`OPERATION_TYPE`	none	any	no	Only journals of this operation type (e.g. vulnerability_decision, waiver_create).
`--target`	`TARGET`	none	any	no	Only journals whose target identifier equals this value exactly.
`--status`	`STATUS`	none	any	no	Only rows with this classification status (e.g. recoverable, complete, corrupt).

Examples

List the decision journals a finished run holds; none means none is pending.

sbomflow decisions transactions --store out

List an interrupted decision, recoverable, as JSON.

sbomflow decisions transactions --store interrupted-evidence --json

Only the journals of one operation type.

sbomflow decisions transactions --store interrupted-evidence --operation-type vulnerability_decision

See also: sbomflow decisions verify-transactions, sbomflow decisions recover, sbomflow review.

`sbomflow decisions verify-transactions`#

Verify each decision-transaction journal against the real state + audit log.

text

Verify every decision-transaction journal against the decision files and the
audit log, and classify each: complete, recoverable, or corrupt. Read-only. A
recoverable or unreadable journal exits 5, so a pipeline can stop on an
unfinished decision.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	one output directory's decision journals, decision files and audit log.
Writes	stdout (one verdict per journal; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` every journal verified complete, or none is pending · `2` missing or unusable directory · `5` a journal is recoverable or unreadable
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`--store`	`STORE`	none	any	yes	OUTPUT_DIR - the analyze/audit output directory (not the evidence store).
`--json`	(flag)	false	—	no	Emit deterministic JSON.
`--limit`	`LIMIT`	1000	any	no	Maximum journals to verify (bounded).
`--operation-type`	`OPERATION_TYPE`	none	any	no	Only journals of this operation type (e.g. vulnerability_decision, waiver_create).
`--target`	`TARGET`	none	any	no	Only journals whose target identifier equals this value exactly.
`--status`	`STATUS`	none	any	no	Only rows with this classification status (e.g. recoverable, complete, corrupt).

Examples

Verify every decision journal against the decisions and the audit log.

sbomflow decisions verify-transactions --store out

Only the complete ones, as JSON.

sbomflow decisions verify-transactions --store out --json --status complete

An interrupted decision is reported recoverable and exits 5. Exits 5.

sbomflow decisions verify-transactions --store interrupted-evidence

See also: sbomflow decisions transactions, sbomflow decisions recover, sbomflow decisions quarantine.

`sbomflow gate`#

Release-gate tools that record nothing (read-only, offline).

text

Release-gate tools that record nothing. The gate itself runs inside analyze
and audit; these verbs ask questions of stored releases without changing any
of them. Name a verb, or the group prints its usage and exits 2.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	nothing itself; its verb reads a local evidence store.
Writes	nothing itself; its verb writes nothing either
Network	offline — This command has no network-capable path.
Exit codes	`0` the verb ran and returned 0 · `2` no verb given, or the verb refused
Machine output	human-only-by-design — group dispatcher: prints usage/guidance only; the machine surfaces are its nested verbs

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit

Examples

Show which stored releases the default policy would have blocked.

sbomflow gate simulate cra-default --store .sbomflow-store

The same for the strict CI preset, as JSON.

sbomflow gate simulate strict-ci --store .sbomflow-store --json

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow gate

See also: sbomflow gate simulate, sbomflow policy show, sbomflow store.

`sbomflow gate simulate`#

Ask which stored releases a policy would have blocked (read-only).

text

Ask 'which stored releases would this policy have blocked?'. Every
release in a local evidence store is re-evaluated read-only against a
shipped preset or a policy file; nothing is written and no stored
decision changes. It is a what-if for choosing a policy, not a gate.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	a policy preset or file, and the releases a local evidence store holds.
Writes	stdout (one would-block row per release; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` unknown policy or unreadable input
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`policy`	`policy`	none	any	yes	A shipped preset name or a policy file path.
`--store`	`STORE`	none	any	yes	Local evidence store directory (see `sbomflow store add`).
`--product`	`PRODUCT`	none	any	no	Only simulate one product (id or any recorded name).
`--releases`	`RELEASES`	none	any	no	Only simulate the N most recent stored releases.
`--as-of`	`AS_OF`	none	any	no	Pin the report's generated_at timestamp (ISO-8601) for reproducible output.
`--json`	(flag)	false	—	no	Emit JSON instead of text.

Examples

Show which stored releases the default policy would have blocked.

sbomflow gate simulate cra-default --store .sbomflow-store

The strict CI preset, as JSON.

sbomflow gate simulate strict-ci --store .sbomflow-store --json

Only the most recent stored release, at a pinned time.

sbomflow gate simulate strict-ci --store .sbomflow-store --releases 1 --as-of 2026-06-21T12:00:00+00:00

See also: sbomflow policy show, sbomflow policy diff, sbomflow store list, sbomflow help goal release-gate.

`sbomflow policy`#

Inspect or diff release-gate policy profiles (read-only, offline).

text

Inspect the release-gate policy profiles: a shipped preset by name, or a
policy file. Both verbs are read-only and offline. Name a verb, or the group
prints its usage and exits 2.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	nothing itself; its verbs read policy presets or files.
Writes	nothing itself; its verbs write nothing either
Network	offline — This command has no network-capable path.
Exit codes	`0` a verb ran and returned 0 · `2` no verb given, or the verb refused
Machine output	human-only-by-design — group dispatcher: prints usage/guidance only; the machine surfaces are its nested verbs

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit

Examples

Show one shipped policy preset and its content hash.

sbomflow policy show strict-ci

Diff two presets field by field.

sbomflow policy diff cra-default strict-ci

Name no verb: print the group's usage and exit 2. Exits 2.

sbomflow policy

See also: sbomflow policy show, sbomflow policy diff, sbomflow gate simulate.

`sbomflow policy diff`#

Deterministic field-level diff of two policy profiles (offline).

text

Compare two policy profiles field by field, deterministically, so a policy
change can be reviewed before a gate enforces it. Each side is a shipped
preset name or a policy file path. Read-only.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	two policy presets or policy files.
Writes	stdout (the field-level diff; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` unknown preset or unreadable file
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`a`	`a`	none	any	yes	First preset name or policy file path.
`b`	`b`	none	any	yes	Second preset name or policy file path.
`--json`	(flag)	false	—	no	Emit JSON instead of text.

Examples

Diff two shipped presets field by field.

sbomflow policy diff cra-default strict-ci

The same diff as JSON.

sbomflow policy diff cra-default strict-ci --json

Refuse a policy that does not exist. Exits 2.

sbomflow policy diff no-such-policy strict-ci

See also: sbomflow policy show, sbomflow gate simulate.

`sbomflow policy show`#

Show a resolved policy profile — its settings + content hash (offline).

text

Resolve one policy profile, a shipped preset name or a policy file path, and
print its settings and the content hash a gate records when it applies it.
Read-only.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	one policy preset or policy file.
Writes	stdout (the resolved settings and content hash; --json prints JSON)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` unknown preset or unreadable file
Machine output	has-json — read/status surface; one versioned JSON document on stdout

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`policy`	`policy`	none	any	yes	A shipped preset name or a policy file path.
`--json`	(flag)	false	—	no	Emit JSON instead of text.

Examples

Show the strict CI preset and its content hash.

sbomflow policy show strict-ci

Show the default preset as JSON.

sbomflow policy show cra-default --json

Refuse a policy that does not exist. Exits 2.

sbomflow policy show no-such-policy

See also: sbomflow policy diff, sbomflow gate simulate, sbomflow analyze.

`sbomflow annotate`#

Render an output directory's gate verdict as native CI annotations (offline).

text

Turn an analyze/audit output directory into native CI annotations so the
release gate's verdict shows up where engineers look - on the pull request.
Annotations go to stdout: redirect the GitLab JSON to your report path.

Fact	Value
Group	`reviewing` — Review decisions, approvals & the release gate
Stability	stable
Regime	any
Reads	release-gate.json and issues.json in an output directory.
Writes	stdout (native CI annotations in the chosen --format)
Network	offline — This command has no network-capable path.
Exit codes	`0` ok · `2` missing or invalid artifacts
Machine output	machine-native — its output IS a machine format: native CI annotations selected with `--format` (github, gitlab)

Options

Option	Value	Default	Allowed	Required	Help
`-h, --help`	(flag)	none	—	no	show this help message and exit
`EVIDENCE_DIR`	`EVIDENCE_DIR`	none	any	yes	Directory produced by 'analyze'/'audit'.
`--format`	`{github,gitlab}`	none	github, gitlab	yes	'github' (workflow commands to stdout) or 'gitlab' (Code Quality JSON to stdout).
`--file`	`ANCHOR_FILE`	none	any	no	Source path to anchor annotations to (GitHub 'file=' / GitLab location.path).
`--max-annotations`	`MAX_ANNOTATIONS`	50	any	no	Cap emitted annotations (default 50); the remainder are summarised.

Examples

Print GitHub workflow-command annotations for the gate's findings.

sbomflow annotate out --format github

Print a GitLab Code Quality report.

sbomflow annotate out --format gitlab

Anchor at most five annotations to one source file.

sbomflow annotate out --format github --max-annotations 5 --file firmware-manifest.txt

See also: sbomflow audit, sbomflow explain, sbomflow quickstart, sbomflow help goal release-gate.

SBOMFlow documentation. Engineering release-evidence support only — not a compliance or conformity claim, and not legal advice.

Review decisions, approvals and the release gate

Overview#

sbomflow review#

sbomflow review-view#

sbomflow review-merge#

sbomflow approve#

sbomflow decisions#

sbomflow decisions quarantine#

sbomflow decisions recover#

sbomflow decisions transactions#

sbomflow decisions verify-transactions#

sbomflow gate#

sbomflow gate simulate#

sbomflow policy#

sbomflow policy diff#

sbomflow policy show#

sbomflow annotate#

`sbomflow review`#

`sbomflow review-view`#

`sbomflow review-merge`#

`sbomflow approve`#

`sbomflow decisions`#

`sbomflow decisions quarantine`#

`sbomflow decisions recover`#

`sbomflow decisions transactions`#

`sbomflow decisions verify-transactions`#

`sbomflow gate`#

`sbomflow gate simulate`#

`sbomflow policy`#

`sbomflow policy diff`#

`sbomflow policy show`#

`sbomflow annotate`#