New language features:
- bom {} block: declares toolchain dependencies (compiler, solver, runtime),
license, and content hash — the spec analog of an SBOM
- Import version pinning: hash and version on import statements for
reproducible builds and dependency integrity
- §3.6.6: SpeckBOM semantics — maps each bom clause to JSON-LD/SPDX
- §3.6.7: Import pinning semantics — hash verification at compile time
- §4.5: Compilation manifest — auto-generated audit-ready JSON-LD output
with spec hash, dependency integrity, toolchain versions, artifact hashes,
verification results, and reproducibility flag
- Updated EBNF grammar for bom_def and import hash/version
- Updated examples (InfusionPumpController shows bom block, PaymentService
shows import pinning)
- Updated Appendix B with SpeckBOM JSON-LD mappings
Together with existing DP primitives (provenance, review, derives, satisfies,
author, source), SpeckBOM provides the full picture: intent provenance +
composition manifest + verification evidence = audit-ready specification.
973a665948