Quality evaluation brief
Validate the installed tool before relying on its evidence.
DEEPBOM records artifact, analyzer, rulepack, target, and evidence identities so an organization can reproduce a result and define its own acceptance criteria.
A successful self-test establishes installation integrity for the bundled probe. It does not validate every model, target, or intended use.
Installation check
npx deepbom self-test
npx deepbom audit path/to/model.tflite --gate defectsThe self-test checks the CLI engine, packaged probe, TFLite WASM guard, Artifact Evidence IR envelope, and CycloneDX 1.7 generation.
Evidence controls
| Determinism | Outputs bind the exact artifact and analyzer identities; generated evidence exposes the inputs and claim boundary. |
|---|---|
| Evidence classes | Observed, derived, source-backed, predicted, estimated, unassessed, and non-applicable states remain distinct. |
| Regression fixtures | Hash-pinned public samples and expected contracts exercise supported formats and export paths. |
| Fail-closed behavior | Malformed artifacts, stale evidence, missing runtime assets, and contract mismatches are reported rather than silently estimated. |
| Change traceability | Release validation records source commit, toolchain versions, checks, and package digests. |
Adoption boundary
- Define the models, formats, targets, outputs, and failure modes relevant to the intended use.
- Run local acceptance cases and retain their artifacts, commands, expected values, and results.
- Review every upgrade before replacing the validated analyzer and rulepack identities.
- Keep runtime and task-performance validation separate from static artifact analysis.
Run a verified browser sample or inspect the public source and checks.