Keep a file with its story
Preserve a trace, dump, coverage file or lab report with the release it belongs to, the scenario, the tool, the operator and the capture date.
Runtime & test evidence
The evidence an SBOM cannot hold.
A release is not only its components. It is the soak-test log, the trace from the rig, the factory or site acceptance capture, the core dump from the run that failed. Those files decide whether a product ships, and they usually live in a shared drive with a date in the filename and nobody’s name on the decision.
Straight status, up front: this is experimental. You can run it in v0.5.0, and the shape of its records may still change without notice. It is one of the areas we most want design partners to shape.
Custody, not analysis
Kept by exact bytes, decided by a named person.
SBOMFlow keeps custody of these files instead of analysing them. Each one is held by its exact bytes, with what a named person stated about it, and every admission and decision is chained so a later edit cannot hide. What the file means is a human’s to say.
$ sbomflow custody verify ./sat-evidence Custody set site-acceptance: intact a1b2c3d4e5f6 records: verified; original: verified decision: accepted by A. Reviewer reviewer: A. Reviewer; reviewed at: 2026-09-19T00:00:00+00:00 note: SAT log reviewed against the signed test plan audit chain: valid (3 events); index: consistent seal: verified Boundary: custody proves byte identity and records what humans stated and decided; it does not analyse artifacts, prove coverage or test success, or make any conformity claim.
Illustrative · the engine prints its own boundary on every custody command
human review required
Byte identity, not a filename
Every file is admitted by its fingerprint and checked again on verification. A decision is bound to those exact bytes, so the same note cannot silently follow a different file — and a mismatch is reported, never repaired.
Originals never leave
A set can keep a local copy of the original, and an export never includes it. Your recipient receives the records and the seal, and checks them against files they already hold. The trace itself stays with you.
A named person, on the record
Accepted, rejected or needs-more-evidence, with a reviewer, a note and a time. The engine records the decision; it never makes one, and a set that cannot vouch for a decision has it shown but not applied.
Joined to the release, or standing alone
Declare a set in a release’s configuration and every record it holds joins that release’s evidence. Or keep it standalone — a supplier handoff that outlives the project that produced it, verifiable offline years later.
What you can do today
From one captured file to a verifiable handoff.
Prove nothing changed
Re-check every record and original later, and tell a removed entry from a rewritten one. A missing or altered file is named, with the reason.
Hand it over
Package a set for a customer or an auditor, and compare two sets to see exactly what moved between them.
Tie it to the firmware
Confirm that a firmware image named in the record belongs to the release that was scanned. That places the image; it does not prove the capture came from it.
Check what a report says about itself
For open formats with a published specification, read the identity a file declares, and compare the source revision a report names with the one the release declares.
Keep what it cannot read
A proprietary or licensed format is still kept, fingerprinted and recorded. Its claims about itself are deliberately not read.
The boundary
Custody decides nothing.
Never reads the content
No event, sample or packet inside a preserved file is interpreted, and no finding is ever drawn from one.
Never moves a gate
A preserved file is context for a reviewer. It sits outside the release gate and outside any regulatory view, so a file dropped in a folder can never become a release decision.
Proves bytes, not authorship
A matching fingerprint proves the file is the one recorded. It does not prove who produced it, or that a test passed.
Bring the test evidence behind your last release.
A soak-test log, a lab report or a rig trace is enough to start. Design partners see this capability as it matures and shape what the record needs to hold. Nothing leaves your environment.