…source

applySourceAssertions adopted a single ingested document's identity -- SPDX
namespace, CycloneDX serial and revision -- and its creation time, name and
comment whenever exactly one document was read, whether or not the graph
being exported still described that document. scan --sbom with --scope
runtime or --enrich hands the exporter a transformed graph beside the
original entry, so a filtered subset was published under the full document's
identity: two documents with different content and one name, which is a
correctness defect in the one field that exists to tell documents apart.

The exporter cannot see the transformation; only the caller knows. So
BuildOptions gains RestatesSource, the caller's declaration that nothing
filtered, enriched, or degraded the graph between ingest and export. Only
then does a conversion adopt its source's identity. The default is false,
the safe side: the document mints its own identity and timestamp, keeps the
default name and no comment, and links the source -- it behaves as a merge
of one. The CLI derives the flag from the same predicate that decides
compositions.aggregate, so a document that cannot claim to be complete
cannot claim to be its source either; --analyze needs --enrich and writes
nothing into the SBOM, so enrichment covers it.

Visible change: a --scope or --enrich export of one SBOM now carries a fresh
serial or namespace and this run's time, with an external reference of type
bom (CycloneDX) or an externalDocumentRef with checksum (SPDX) naming the
source. The fixed point still holds for restating exports and is pinned
without pinning anything else.

ADR-0042 is amended in place; ADR-0037 cross-references it.

Closes #433.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

…wn its source

Codex review on #461: the degraded argument was computed from any detector
warning being present, while PipelineResult asks consumers concerned with
coverage to filter on DetectorWarning.DegradesCoverage. A package-manager
readiness notice therefore made an unfiltered scan declare its completeness
unknown and mint a new identity for an unchanged source. coverageDegraded
filters on the kind, and feeds both the aggregate claim and restatement.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

… whatever the caller declared

Codex review on #461: a directory scan can hold one auto-detected SBOM
entry beside native manifest entries; the source count skipped entries
without a document, saw one source, and adopted its identity over a graph
holding packages the document never named. FromGraphEntries now withdraws
restatement when any entry carries a graph but no document -- decided at
the model boundary, where the entries are visible, rather than by each
caller. A lone document still restates.

Co-Authored-By: Claude Fable 5.1 <[email protected]>