# Portfolio evidence and inventory scope

Reviewed on 15 October 2026. The project diagrams and engineering posts are the primary deliverables; these files provide supporting supply-chain evidence.

## Reviewed snapshots

- NetHero: `a9b661e99462dd502ecf009860f542cbe4e4035f`
- DanielScience: `ac7441ce42996510aa4e339638aa47a508e854b8`

## NetHero review environment

The SBOM is a tool-generated CycloneDX 1.6 inventory of a fresh Python 3.14 virtual environment with the project's `web` extra installed. It is not a lockfile-derived inventory or a production-host SBOM. The repository declares lower-bound version constraints, so another resolution can select different versions.

The generator and auditor were installed in a separate tooling environment, rather than inside the application environment. The application environment includes pip; pip was upgraded before the final inventory and audit. This corrects the earlier draft's inclusion of analysis tooling in the application inventory.

Commands, with paths shortened for readability:

```sh
python3 -m venv /tmp/nethero-runtime-review
/tmp/nethero-runtime-review/bin/pip install '/tmp/NetHero_web[web]'
/tmp/nethero-runtime-review/bin/pip install --upgrade pip
/tmp/nh_venv/bin/cyclonedx-py environment \
  --pyproject /tmp/NetHero_web/pyproject.toml \
  --sv 1.6 --of JSON --validate \
  -o assets/sbom/nethero-sbom.cdx.json \
  /tmp/nethero-runtime-review/bin/python
/tmp/nh_venv/bin/pip-audit \
  --path /tmp/nethero-runtime-review/lib/python3.14/site-packages \
  -f json -o assets/sbom/nethero-pip-audit.json
```

Tools: cyclonedx-py 7.5.0 and pip-audit 2.10.1. CycloneDX validation is enabled at generation. Package versions, dependency relationships, and any license metadata are recorded in the JSON; missing metadata is not a license clearance.

The audit is a known-advisory lookup for that environment. It does not establish exploitability, application security, production equivalence, or future safety.

## Focused PCAP tests

The local execution used the separate review tooling environment with the web dependencies and pytest installed:

```sh
/tmp/nh_venv/bin/pytest -q /tmp/NetHero_web/tests/test_pcap_*.py \
  -o pythonpath=/tmp/NetHero_web/src --disable-warnings
```

Result: **119 passed, 4 warnings in 2.41 seconds**. This is a focused test run, not full-suite validation, a coverage measurement, or a load test. Some API tests isolate dependencies with mocks.

## DanielScience build and news-generation toolchain

The CycloneDX inventory was generated from the committed `package-lock.json` using `@cyclonedx/cyclonedx-npm` 6.0.1 with `--package-lock-only`. The working lockfile used for generation and npm audit was byte-for-byte identical to the reviewed repository lockfile.

```sh
npx @cyclonedx/cyclonedx-npm \
  --output-file assets/sbom/danielscience-sbom.cdx.json \
  --output-format JSON --package-lock-only
npm audit --json --package-lock-only
```

This scope includes site-generation packages and the Anthropic SDK/RSS news workflow, even though package.json labels them development dependencies. It excludes the operating system, Nginx, SSH, GitHub-hosted runners, and production infrastructure.

The captured npm audit reports 14 affected dependency entries: 11 high and three moderate. This is not necessarily 14 distinct CVEs. Findings include SDK transitive packages such as form-data as well as site-generation packages; the prior draft's claim that they were all Eleventy dependencies was incorrect.

An update dry run does not establish that no fix exists. Consult each advisory and test compatible upgrades; no dependency remediation is performed in this editorial PR.

## Graphics and regeneration

```sh
node scripts/generate-portfolio-graphics.js
```

The figures illustrate source-reviewed workflows. They do not assert measured productivity improvements, real customer outcomes, benchmark performance, or calibrated diagnostic accuracy. PNG exports are included for interview reuse.