feat(sbom): derive and verify bundle dependency closure

.github/workflows/verify.yml

@@ -6,7 +6,7 @@ name: verify
 #   format:check -> lint -> typecheck -> test -> build -> validate:provenance ->
 #   validate:skill -> validate:reading -> validate:docs -> smoke -> forward:test ->
 #   package:hosts -> verify:hosts -> verify:install -> check:doc-counts ->
-#   scan:deps -> scan:licenses -> scan:secrets
+#   scan:deps -> scan:licenses -> validate:sbom -> scan:secrets
 #
 # The full local gate is `pnpm run verify:all = verify:cloud + scan:incident`.  Its precise
 # incident tokens intentionally live only in a controlled local file and must never be copied to

AGENTS.md

@@ -56,7 +56,7 @@ pnpm run build        # rebuild scripts/dist/engine.mjs + sbom.cdx.json (commit
 `verify:cloud` runs the reproducible, non-sensitive stages: `format:check → lint → typecheck → test
 → build → validate:provenance → validate:skill → validate:reading → validate:docs → smoke →
 forward:test → package:hosts → verify:hosts → verify:install → check:doc-counts → scan:deps →
-scan:licenses → scan:secrets`. `verify:all` then adds `scan:incident`; its precise token file is ignored, must never
+scan:licenses → validate:sbom → scan:secrets`. `verify:all` then adds `scan:incident`; its precise token file is ignored, must never
 enter CI, and its absence is intentionally fail-closed. If you change the test count, update
 `docs/STATUS.md` and `docs/VALIDATION.md` from a real run (never by hand).
 

README.md

@@ -206,7 +206,7 @@ pnpm run package      # 生成 dist/*.zip + .sha256（自校验完整性）
 
 `verify:cloud` 依次运行：`format:check → lint → typecheck → test → build → validate:provenance →
 validate:skill → validate:reading → validate:docs → smoke → forward:test → package:hosts →
-verify:hosts → verify:install → check:doc-counts → scan:deps → scan:licenses → scan:secrets`。`verify:all` 只在其后追加
+verify:hosts → verify:install → check:doc-counts → scan:deps → scan:licenses → validate:sbom → scan:secrets`。`verify:all` 只在其后追加
 `scan:incident`，该扫描的私密 token 文件绝不进入 CI；缺失时必须 fail-closed。本仓库当前的真实测试计数由 GitHub Actions 的 `verify` job 与 [`docs/VALIDATION.md`](docs/VALIDATION.md) 的门禁段落负责同步（不再在 README 内维护一个易过期的静态数字）。
 
 深入阅读：[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) · [`docs/VALIDATION.md`](docs/VALIDATION.md) ·

docs/ARCHITECTURE.md

@@ -66,6 +66,13 @@ contracts  <-  time-location  <-  orchestrator  ->  engine-entry (esbuild)  ->
 - its packed TZDB) into `scripts/dist/engine.mjs`, and writes `sbom.cdx.json`. The published Skill
   depends on neither `packages/` nor `node_modules`, and performs no install or network at runtime.
 
+Both SBOMs (`sbom.cdx.json` CycloneDX and `sbom.spdx.json` SPDX 2.3) are derived from the esbuild
+metafile's `inputs` list via `tools/lib/bundle-closure.ts` — there is no hand-maintained package
+list. If a new third-party package ends up in the bundle, both SBOMs pick it up; if a package
+disappears, both SBOMs drop it. `pnpm run validate:sbom` re-runs esbuild independently in
+`verify:cloud` and requires an exact match (name/version/purl/license) between the fresh closure
+and both committed SBOMs, fail-closed on any drift.
+
 ## Time & location (the critical layer)
 
 Local civil time is normalized exactly once: parse wall clock → resolve against historical IANA

docs/LICENSE_AUDIT.md

@@ -7,6 +7,11 @@
 - **Enforced in the gate**: `pnpm run scan:licenses` (in `verify:cloud`) checks the whole
   production dependency closure against this policy offline and cross-checks the committed SBOM
   license claims; it fails closed.
+- **Bundle-closure gate**: `pnpm run validate:sbom` (also in `verify:cloud`) re-runs esbuild,
+  derives the actual third-party runtime closure from the metafile, and requires both
+  `sbom.cdx.json` and `sbom.spdx.json` to record exactly that closure with matching
+  name/version/purl/license. The SBOM is derived from the metafile at build time — no
+  hand-maintained package list can drift from bundle reality.
 - This file is not legal advice; re-verify before any commercial release.
 
 ## Bundled into the published engine (`scripts/dist/engine.mjs`)

docs/STATUS.md

@@ -179,7 +179,7 @@ never by hand.
 | Command                        | Result                                                                                                                                                                                                                                                                                                                                    |
 | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `pnpm run typecheck`           | clean (tsc strict over packages, tools, tests)                                                                                                                                                                                                                                                                                            |
-| `pnpm run test`                | 472 tests / 29 files �all passing (all systems + JPL Horizons 独立 golden + interpret + 吉凶 + 合婚 + reading-lint/空话/重复/越界 + validate-answer v2 结构与措辞门禁（约束引用事实豁免+全可见文本安全扫�资源上限+有界解析入口，非语义正确性证明） + western-rules/ziwei-rules 语义规则 + 版本迁移/回滚/目标白名�+ PII 隐私护栏 green) |
+| `pnpm run test`                | 556 tests / 31 files �all passing (all systems + JPL Horizons 独立 golden + interpret + 吉凶 + 合婚 + reading-lint/空话/重复/越界 + validate-answer v2 结构与措辞门禁（约束引用事实豁免+全可见文本安全扫�资源上限+有界解析入口，非语义正确性证明） + western-rules/ziwei-rules 语义规则 + 版本迁移/回滚/目标白名�+ PII 隐私护栏 green) |
 | `pnpm run build`               | `engine.mjs` ï¿?2.8 MB + `sbom.cdx.json` + `sbom.spdx.json` (6 runtime deps)                                                                                                                                                                                                                                                               |
 | `pnpm run validate:skill`      | 40 / 40 (incl. scripts/ no-stray-files guard + CycloneDX/SPDX SBOM checks + validate-answer/lint-reading gate-workflow doc checks)                                                                                                                                                                                                        |
 | `pnpm run validate:reading`    | 53 / 53 (topic example libraries + output-spec structure + 无术语区 firewall; offline, no LLM)                                                                                                                                                                                                                                            |

docs/VALIDATION.md

@@ -34,6 +34,7 @@ Before a release or a visibility change, run `pnpm run verify:all` and
 | Doc counts       | `pnpm run check:doc-counts`                       | Re-runs the suite; fails if a doc's `N tests / M files` drifts from the run.                           |
 | Dep vuln scan    | `pnpm run scan:deps`                              | Local: WARN + exit 0 if offline. CI: `DEPENDENCY_AUDIT_STRICT=1` fails closed on unreachable/parse.    |
 | License scan     | `pnpm run scan:licenses`                          | Offline `pnpm licenses` policy gate (LICENSE_AUDIT allowlist) + SBOM license cross-check; fail-closed. |
+| SBOM validate    | `pnpm run validate:sbom`                          | Fresh esbuild bundle closure vs both committed SBOMs; any drift/ghost/byte diff fails closed.          |
 | Secret scan      | `pnpm run scan:secrets`                           | Dependency-free scan of tracked files; fails on a leaked credential.                                   |
 | Incident scan    | local `pnpm run verify:all`                       | Exact incident tokens; fail-closed if the controlled token file is unavailable.                        |
 
@@ -58,7 +59,7 @@ the identical table in [STATUS.md](./STATUS.md) ("Commands & results"). Do not h
 resolve a disagreement; re-run the suite and copy the actual count. `pnpm run check:doc-counts`
 re-runs the suite and fails if either doc's `N tests / M files` count drifts from the real run.
 
-- Typecheck: clean. Tests: **472 tests / 29 files ï¿?all passing**. The Western provider
+- Typecheck: clean. Tests: **556 tests / 31 files ï¿?all passing**. The Western provider
   (astronomy-engine, VSOP87 + NOVAS) passes the ADR-0003 ï¿?ï¿?gate two ways: wrapper-consistency
   (vs astronomy-engine's own output) plus an **independent JPL Horizons golden** (10 bodies × 3
   technical epochs fetched from the NASA/JPL Horizons service, query recorded in

package.json

@@ -18,6 +18,7 @@
     "validate:reading": "node tools/validate-reading-examples.ts",
     "validate:docs": "node tools/validate-current-docs.ts",
     "validate:provenance": "node tools/validate-provenance.ts",
+    "validate:sbom": "node tools/validate-sbom.ts",
     "smoke": "node tools/smoke-clean-dir.ts",
     "forward:test": "node tools/forward-test.ts",
     "example": "node tools/gen-example.ts",
@@ -37,7 +38,7 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "lint": "eslint packages",
-    "verify:cloud": "pnpm run format:check && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && pnpm run validate:provenance && pnpm run validate:skill && pnpm run validate:reading && pnpm run validate:docs && pnpm run smoke && pnpm run forward:test && pnpm run package:hosts && pnpm run verify:hosts && pnpm run verify:install && pnpm run check:doc-counts && pnpm run scan:deps && pnpm run scan:licenses && pnpm run scan:secrets",
+    "verify:cloud": "pnpm run format:check && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && pnpm run validate:provenance && pnpm run validate:skill && pnpm run validate:reading && pnpm run validate:docs && pnpm run smoke && pnpm run forward:test && pnpm run package:hosts && pnpm run verify:hosts && pnpm run verify:install && pnpm run check:doc-counts && pnpm run scan:deps && pnpm run scan:licenses && pnpm run validate:sbom && pnpm run scan:secrets",
     "verify:all": "pnpm run verify:cloud && pnpm run scan:incident"
   },
   "devDependencies": {

skills/calculate-birth-charts/sbom.cdx.json

@@ -18,9 +18,9 @@
   "components": [
     {
       "type": "library",
-      "name": "zod",
-      "version": "4.4.3",
-      "purl": "pkg:npm/zod@4.4.3",
+      "name": "astronomy-engine",
+      "version": "2.1.19",
+      "purl": "pkg:npm/astronomy-engine@2.1.19",
       "licenses": [
         {
           "license": {
@@ -31,9 +31,61 @@
     },
     {
       "type": "library",
-      "name": "moment-timezone",
-      "version": "0.6.3",
-      "purl": "pkg:npm/moment-timezone@0.6.3",
+      "name": "dayjs",
+      "version": "1.11.21",
+      "purl": "pkg:npm/dayjs@1.11.21",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "name": "i18next",
+      "version": "23.16.8",
+      "purl": "pkg:npm/i18next@23.16.8",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "name": "iztro",
+      "version": "2.5.8",
+      "purl": "pkg:npm/iztro@2.5.8",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "name": "lunar-lite",
+      "version": "0.2.8",
+      "purl": "pkg:npm/lunar-lite@0.2.8",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ]
+    },
+    {
+      "type": "library",
+      "name": "lunar-typescript",
+      "version": "1.8.6",
+      "purl": "pkg:npm/lunar-typescript@1.8.6",
       "licenses": [
         {
           "license": {
@@ -57,9 +109,9 @@
     },
     {
       "type": "library",
-      "name": "tyme4ts",
-      "version": "1.5.2",
-      "purl": "pkg:npm/tyme4ts@1.5.2",
+      "name": "moment-timezone",
+      "version": "0.6.3",
+      "purl": "pkg:npm/moment-timezone@0.6.3",
       "licenses": [
         {
           "license": {
@@ -70,9 +122,9 @@
     },
     {
       "type": "library",
-      "name": "iztro",
-      "version": "2.5.8",
-      "purl": "pkg:npm/iztro@2.5.8",
+      "name": "tyme4ts",
+      "version": "1.5.2",
+      "purl": "pkg:npm/tyme4ts@1.5.2",
       "licenses": [
         {
           "license": {
@@ -83,9 +135,9 @@
     },
     {
       "type": "library",
-      "name": "astronomy-engine",
-      "version": "2.1.19",
-      "purl": "pkg:npm/astronomy-engine@2.1.19",
+      "name": "zod",
+      "version": "4.4.3",
+      "purl": "pkg:npm/zod@4.4.3",
       "licenses": [
         {
           "license": {