## 1. Red deterministic contract

- [x] 1.1 Add a focused test requiring SPDX 2.3 fields, source/Protocol/module relationships, two architectures, and exact artifact hashes
- [x] 1.2 Prove current packaging cannot produce the required standard SBOM

## 2. Standard-library generator

- [x] 2.1 Implement bounded deterministic SPDX JSON generation from explicit build and Go module metadata
- [x] 2.2 Record truthful license fields, notices/provenance, unscanned status, and no signing claim

## 3. Verification

- [x] 3.1 Prove byte-stable regeneration and rejection of dirty, missing, mismatched, or ambiguous inputs
- [x] 3.2 Reconcile the deployment-artifact canonical spec and run strict validation