Provenance

The SBOM was built for software a vendor assembles at build time and ships. An open source agent that writes code and pulls dependencies at runtime breaks that model, and adds a question the format cannot answer: who wrote the code.