Commands / kosa8 ai bom
kosa8 ai bom
Write a CycloneDX 1.6 AI bill of materials for a sandbox, session or model
Usage
kosa8 bom (--sandbox S | --session ID | --model M)
An AI bill of materials says what an AI workload was made of: the model, by the SHA-256 of its weights, with its source, signature and approval; the inference runtime; the MCP servers its agent was offered, used and refused; and the signed policies in force.
--sandbox and --session read what the audit log recorded for that workload
(kosa8 model serve and kosa8 mcp serve with --sandbox/--session); --model
describes a stored model as it would be served now. Output is deterministic:
the same records give the same bytes, and there is no timestamp unless you
pass --timestamp.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--model | string | a stored model, by local name | — |
-o, --out | string | write to this file instead of stdout | — |
--sandbox | string | the sandbox the AI workload ran in | — |
--session | string | an AI session id (from kosa8 model serve or kosa8 mcp serve) | — |
--timestamp | string | RFC 3339 time for metadata.timestamp (default: none, so output is reproducible) | — |