.gitattributes
.gitignore
.pre-commit-config.yaml
.python-version
.readthedocs.yaml
.secrets.baseline
.tool-versions
AGENTS.md
CONTRIBUTING.md
LICENSE
Makefile
README.md
SECURITY.md
pyproject.toml
renovate.json
uv.lock
.github/CODEOWNERS
.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/dependency-review.yml
.github/workflows/fuzz.yml
.github/workflows/pages.yml
.github/workflows/pre-commit.yml
.github/workflows/pypi.yml
.github/workflows/release-validation.yml
.github/workflows/release.yml
.github/workflows/scorecard.yml
.github/workflows/sync-style-guide.yml
docs/conf.py
docs/execution-report-v1.schema.json
docs/index.md
docs/_templates/about.html
docs/_templates/navigation.html
docs/_templates/relations.html
docs/_templates/searchfield.html
docs/assets/vexcalibur-banner.png
docs/assets/badges/ci.svg
docs/assets/badges/codeql.svg
docs/assets/badges/dependency-review.svg
docs/assets/badges/scorecard.svg
docs/development/ci.md
docs/development/fuzzing.md
docs/development/github-governance.md
docs/development/python-style.md
docs/examples/generate_custom_execution_report.py
docs/examples/generate_execution_report.py
docs/examples/use_python_api.py
docs/examples/validate_execution_report.py
docs/explanation/architecture.md
docs/explanation/project-status.md
docs/explanation/self-release-evidence.md
docs/external/README.md
docs/external/google-python-style-guide.md
docs/how-to/build-release-evidence.md
docs/how-to/consume-execution-report.md
docs/how-to/generate-csaf.md
docs/how-to/generate-cyclonedx-vex.md
docs/how-to/generate-execution-report-from-python.md
docs/how-to/generate-openvex.md
docs/how-to/publish-to-pypi.md
docs/how-to/use-private-osv-mirror.md
docs/how-to/use-python-api.md
docs/reference/cli.md
docs/reference/csaf-output.md
docs/reference/cyclonedx-vex-output.md
docs/reference/execution-report.md
docs/reference/local-findings.md
docs/reference/openvex-output.md
docs/reference/provider-contract.md
docs/reference/python-api.rst
docs/reference/release-evidence.md
docs/reference/renderer-contract.md
docs/tutorials/offline-local-findings.md
docs/tutorials/quickstart.md
release-evidence/README.md
release-evidence/findings.json
release-evidence/recovery-contract.json
release-evidence/review.json
scripts/append_locked_distribution_requirement.py
scripts/archive_limits.py
scripts/check-execution-report-posix.sh
scripts/check-execution-report-windows.ps1
scripts/check-installed-cli.sh
scripts/check-installed-csaf.sh
scripts/check-recovery-contract.py
scripts/check-release-evidence.sh
scripts/check_docs_accessibility.py
scripts/check_github_governance.py
scripts/execution_report_oracle.py
scripts/generate-release-evidence.sh
scripts/install-locked-distribution.sh
scripts/next-release-tag.sh
scripts/normalize-sdist.py
scripts/prepare-local-release-tag.sh
scripts/release_evidence.py
scripts/resolve-publication-version.sh
scripts/run-atheris.sh
scripts/run-dist-metadata-verifier.sh
scripts/select-pypi-release-files.py
scripts/verify-dist-metadata.py
src/vexcalibur/__init__.py
src/vexcalibur/_version.py
src/vexcalibur/api.py
src/vexcalibur/cli.py
src/vexcalibur/csaf.py
src/vexcalibur/document.py
src/vexcalibur/domain.py
src/vexcalibur/errors.py
src/vexcalibur/execution_report_destination.py
src/vexcalibur/execution_report_errors.py
src/vexcalibur/execution_report_filesystem.py
src/vexcalibur/execution_report_lifecycle.py
src/vexcalibur/execution_report_locks.py
src/vexcalibur/execution_report_staging.py
src/vexcalibur/execution_report_validation.py
src/vexcalibur/generate.py
src/vexcalibur/generate_command.py
src/vexcalibur/generation_context.py
src/vexcalibur/generation_output.py
src/vexcalibur/generation_result.py
src/vexcalibur/generation_selection.py
src/vexcalibur/generation_snapshot.py
src/vexcalibur/github_sbom.py
src/vexcalibur/input_file.py
src/vexcalibur/json_boundary.py
src/vexcalibur/limits.py
src/vexcalibur/openvex.py
src/vexcalibur/py.typed
src/vexcalibur/render.py
src/vexcalibur/render_budget.py
src/vexcalibur/sbom.py
src/vexcalibur/source_options.py
src/vexcalibur/url_policy.py
src/vexcalibur/version_identity.py
src/vexcalibur/vex.py
src/vexcalibur.egg-info/PKG-INFO
src/vexcalibur.egg-info/SOURCES.txt
src/vexcalibur.egg-info/dependency_links.txt
src/vexcalibur.egg-info/entry_points.txt
src/vexcalibur.egg-info/requires.txt
src/vexcalibur.egg-info/scm_file_list.json
src/vexcalibur.egg-info/scm_version.json
src/vexcalibur.egg-info/top_level.txt
src/vexcalibur/compat/__init__.py
src/vexcalibur/compat/vexy.py
src/vexcalibur/sources/__init__.py
src/vexcalibur/sources/local.py
src/vexcalibur/sources/osv.py
tests/__init__.py
tests/archive_fixtures.py
tests/release_workflow_helpers.py
tests/test_append_locked_distribution_requirement.py
tests/test_check_recovery_contract.py
tests/test_ci_workflow_contract.py
tests/test_cli.py
tests/test_cli_execution_report.py
tests/test_cli_execution_report_failures.py
tests/test_csaf.py
tests/test_docs_accessibility.py
tests/test_document.py
tests/test_documented_ci.py
tests/test_execution_report.py
tests/test_execution_report_consumer_example.py
tests/test_execution_report_destination.py
tests/test_execution_report_destination_cli.py
tests/test_execution_report_destination_locks.py
tests/test_execution_report_errors.py
tests/test_execution_report_hardening.py
tests/test_execution_report_lifecycle.py
tests/test_execution_report_oracle.py
tests/test_execution_report_rollback.py
tests/test_execution_report_validation.py
tests/test_fuzz_runner.py
tests/test_generate.py
tests/test_generate_command.py
tests/test_generation_document_write.py
tests/test_generation_output.py
tests/test_generation_output_concurrency.py
tests/test_generation_output_recovery.py
tests/test_generation_result.py
tests/test_generation_result_isolation.py
tests/test_generation_result_provenance.py
tests/test_generation_result_validation.py
tests/test_github_generation_orchestration.py
tests/test_github_governance.py
tests/test_github_sbom.py
tests/test_input_file.py
tests/test_json_boundary.py
tests/test_local_findings.py
tests/test_normalize_sdist.py
tests/test_openvex.py
tests/test_osv_client.py
tests/test_osv_output_safety.py
tests/test_output_limits.py
tests/test_prepare_local_release_tag.py
tests/test_public_api.py
tests/test_release_archive_limits.py
tests/test_release_evidence.py
tests/test_release_policy.py
tests/test_release_publication_evidence.py
tests/test_release_version.py
tests/test_release_workflow_security.py
tests/test_release_workflow_state_machine.py
tests/test_renovate_configuration.py
tests/test_resolve_publication_version.py
tests/test_sbom.py
tests/test_select_pypi_release_files.py
tests/test_tar_archive_limits.py
tests/test_verify_dist_metadata.py
tests/test_version_identity.py
tests/test_vex.py
tests/test_vexy_compat.py
tests/test_zip_archive_limits.py
tests/fixtures/findings/all-analysis-states.json
tests/fixtures/governance/expected.json
tests/fixtures/release-evidence/findings.json
tests/fixtures/release-evidence/review.json
tests/fixtures/sbom/cyclonedx-json-1.4-simple.json
tests/fixtures/sbom/cyclonedx-json-1.5-simple.json
tests/fixtures/sbom/cyclonedx-json-simple.json
tests/fixtures/sbom/cyclonedx-xml-1.4-simple.xml
tests/fixtures/sbom/cyclonedx-xml-1.5-simple.xml
tests/fixtures/sbom/cyclonedx-xml-simple.xml
tests/fixtures/schemas/README.md
tests/fixtures/schemas/csaf-2.0.schema.json
tests/fixtures/schemas/openvex-0.2.0.schema.json
tests/fixtures/vexy/legacy-config.yml
tests/fuzz/__init__.py
tests/fuzz/boundaries.py
tests/fuzz/conftest.py
tests/fuzz/fuzz_boundaries.py
tests/fuzz/test_boundaries.py
tests/fuzz/corpus/github/valid-spdx.json
tests/fuzz/corpus/identity/unicode.txt
tests/fuzz/corpus/json/deep-nesting.json
tests/fuzz/corpus/json/duplicate-key.json
tests/fuzz/corpus/local/valid-findings.json
tests/fuzz/corpus/osv/multi-page-query.json
tests/fuzz/corpus/osv/safe-query.json
tests/fuzz/corpus/osv/terminal-control.json
tests/fuzz/corpus/osv/valid-batch.json
tests/fuzz/corpus/osv/valid-get.json
tests/fuzz/corpus/osv/valid-gzip-query.json
tests/fuzz/corpus/report/malformed-utf8.hex
tests/fuzz/corpus/report/valid-multibyte.txt
tests/fuzz/corpus/sbom/forbidden-entity.xml
tests/fuzz/corpus/sbom/invalid-spec-version.json
tests/fuzz/corpus/sbom/non-string-spec-version.json
tests/fuzz/corpus/sbom/valid-json.json
tests/fuzz/corpus/sbom/valid-xml.xml
tests/golden/csaf-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-simple.json
tests/golden/openvex-vex-all-analysis-states.json
tests/golden/vexy-compat-cli.json
tests/integration/check_installed_cli.py
tests/integration/check_installed_csaf.py
tests/integration/check_installed_windows.py
tests/integration/publish_generation_transaction.py
tests/integration/csaf-validator/.npmrc
tests/integration/csaf-validator/README.md
tests/integration/csaf-validator/package-lock.json
tests/integration/csaf-validator/package.json
tests/integration/csaf-validator/validate.mjs
tests/integration/openvex-go/go.mod
tests/integration/openvex-go/go.sum
tests/integration/openvex-go/main.go