{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:L7ZLZOQEKJPAGCFZWAKDDDJS62","short_pith_number":"pith:L7ZLZOQE","canonical_record":{"source":{"id":"2606.19390","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-06-16T11:42:42Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"b0c7869fed91065eb4fc3b12fec496020b4ebb486a54110f6ec1bed2f648b0c4","abstract_canon_sha256":"f54b524a441abbc6913a50455e3a86eb32815a122d0d7006569588d6fa46821e"},"schema_version":"1.0"},"canonical_sha256":"5ff2bcba04525e0308b9b014318d32f691b4812a3508da70abf4b462ce68d9fb","source":{"kind":"arxiv","id":"2606.19390","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.19390","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"arxiv_version","alias_value":"2606.19390v1","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.19390","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_12","alias_value":"L7ZLZOQEKJPA","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_16","alias_value":"L7ZLZOQEKJPAGCFZ","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_8","alias_value":"L7ZLZOQE","created_at":"2026-06-19T16:12:23Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:L7ZLZOQEKJPAGCFZWAKDDDJS62","target":"record","payload":{"canonical_record":{"source":{"id":"2606.19390","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-06-16T11:42:42Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"b0c7869fed91065eb4fc3b12fec496020b4ebb486a54110f6ec1bed2f648b0c4","abstract_canon_sha256":"f54b524a441abbc6913a50455e3a86eb32815a122d0d7006569588d6fa46821e"},"schema_version":"1.0"},"canonical_sha256":"5ff2bcba04525e0308b9b014318d32f691b4812a3508da70abf4b462ce68d9fb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-19T16:12:23.919950Z","signature_b64":"UcfbBipwNmY4/6oIn9RV10hYZ1kYZByVjZT2PGtYRL1s7oln3MvX3oHCnK3EhYGHZ+NvcnTlDZSMD3js/Q82Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5ff2bcba04525e0308b9b014318d32f691b4812a3508da70abf4b462ce68d9fb","last_reissued_at":"2026-06-19T16:12:23.919544Z","signature_status":"signed_v1","first_computed_at":"2026-06-19T16:12:23.919544Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.19390","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-19T16:12:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"tI4Q+AVbpXGM75dXETUvZch6FM1f4/Jyq7h8hPvMafAQXACMYKf6iPEOyX7dVV76mXBhmOgGymOfNdvGxSztAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T06:20:05.866608Z"},"content_sha256":"797b1ff0766318b77dd3a45cc58057dbc864264ff1b0d935aede6dc863aa32f2","schema_version":"1.0","event_id":"sha256:797b1ff0766318b77dd3a45cc58057dbc864264ff1b0d935aede6dc863aa32f2"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:L7ZLZOQEKJPAGCFZWAKDDDJS62","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.SE","authors_text":"Carsten Maple, Kay Atefi, Omar Santos, Petar Radanliev","submitted_at":"2026-06-16T11:42:42Z","abstract_excerpt":"A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets."},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.19390","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.19390/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-19T16:12:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ky5ueEviGhMC6HzYuxwz2yVz8CZw6gOPI6fmGtpBmWWw6Mzf2eGydwBZDFNd6Xe5Iy35k2kBGrqpTCxlg+UlAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T06:20:05.867138Z"},"content_sha256":"1f1df5f7ef19b31f8633f2df670b117af67edc65c1e74f25960f79f2344655dd","schema_version":"1.0","event_id":"sha256:1f1df5f7ef19b31f8633f2df670b117af67edc65c1e74f25960f79f2344655dd"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:L7ZLZOQEKJPAGCFZWAKDDDJS62","target":"integrity","payload":{"note":"DOI in the printed bibliography is fragmented by whitespace or line breaks. A longer candidate (10.1080/19393555.2025.2498466;journal:journal:uiss19;wgroup:sTRING:PUBLICATION) was visible in the surrounding text but could not be confirmed against doi.org as printed.","snippet":"Azizi, Sara., Pakshad, Puya., Shameli-Sendi, Alireza., and Faraji Daneshgar, Fateme, ‘Vulnerability scoring metric of CVSS needs to be adjusted per each product: our analysis on Linux and Apache’, Information Security Journal, May 2025, doi","arxiv_id":"2606.19390","detector":"doi_compliance","evidence":{"ref_index":49,"verdict_class":"incontrovertible","resolved_title":null,"printed_excerpt":"Azizi, Sara., Pakshad, Puya., Shameli-Sendi, Alireza., and Faraji Daneshgar, Fateme, ‘Vulnerability scoring metric of CVSS needs to be adjusted per each product: our analysis on Linux and Apache’, Information Security Journal, May 2025, doi","reconstructed_doi":"10.1080/19393555.2025.2498466;journal:journal:uiss19;wgroup:sTRING:PUBLICATION"},"severity":"advisory","ref_index":49,"audited_at":"2026-07-09T23:06:04.255420Z","event_type":"pith.integrity.v1","detected_doi":"10.1080/19393555.2025.2498466;journal:journal:uiss19;wgroup:sTRING:PUBLICATION","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"fbe69957f01216cf77bd5f875fa06539d3777b7d5dc69548ffd7c28c4a199c3d","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"1.0.0","detected_arxiv_id":null,"integrity_event_id":11165,"payload_sha256":"f41f0be15a90f559010c9162abbd3afe6de65ff1b8f49082697df6fc6009fbcf","signature_b64":"Tmxw7AM27II5W2ORqhCx51ocgCUlAoBegBSzQ5sH4KEHwBG4CXyTaFbcP2eyAC+afp6SjAPOYv1WchvHPMfjBA==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-09T23:08:23Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9Iq1Ewri6S/JUwlMSyy5f4YwWHR1yJcmyOhdAwn295BjhbtmtUnN4jgj/bC2Ydf/Agw3TAqDZBvVJKiRjbDzAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-13T06:20:05.870065Z"},"content_sha256":"0edfa00c0b09bd19f93c99b5ab401892e42284e7469ddce2147b5e878e535781","schema_version":"1.0","event_id":"sha256:0edfa00c0b09bd19f93c99b5ab401892e42284e7469ddce2147b5e878e535781"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/bundle.json","state_url":"https://pith.science/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-13T06:20:05Z","links":{"resolver":"https://pith.science/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62","bundle":"https://pith.science/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/bundle.json","state":"https://pith.science/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/state.json","well_known_bundle":"https://pith.science/.well-known/pith/L7ZLZOQEKJPAGCFZWAKDDDJS62/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:L7ZLZOQEKJPAGCFZWAKDDDJS62","merge_version":"pith-open-graph-merge-v1","event_count":3,"valid_event_count":3,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f54b524a441abbc6913a50455e3a86eb32815a122d0d7006569588d6fa46821e","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-06-16T11:42:42Z","title_canon_sha256":"b0c7869fed91065eb4fc3b12fec496020b4ebb486a54110f6ec1bed2f648b0c4"},"schema_version":"1.0","source":{"id":"2606.19390","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.19390","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"arxiv_version","alias_value":"2606.19390v1","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.19390","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_12","alias_value":"L7ZLZOQEKJPA","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_16","alias_value":"L7ZLZOQEKJPAGCFZ","created_at":"2026-06-19T16:12:23Z"},{"alias_kind":"pith_short_8","alias_value":"L7ZLZOQE","created_at":"2026-06-19T16:12:23Z"}],"graph_snapshots":[{"event_id":"sha256:1f1df5f7ef19b31f8633f2df670b117af67edc65c1e74f25960f79f2344655dd","target":"graph","created_at":"2026-06-19T16:12:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.19390/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"A protocol driven framework is presented that binds SBOM and AIBOM artefacts to deterministic environment capture and structured runtime telemetry. Exploitability is computed from declared artefacts, observed activation conditions, and enforced execution policies. CSAF VEX advisories are generated from combined static and runtime evidence, cryptographically signed, and validated through deterministic replay. Evaluation uses approximately 10000 component entries across synthetic Agentic AI workloads 50 to 5000 components, incorporating OSV, GitHub Advisory, KEV, and EPSS datasets.","authors_text":"Carsten Maple, Kay Atefi, Omar Santos, Petar Radanliev","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-06-16T11:42:42Z","title":"Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.19390","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:797b1ff0766318b77dd3a45cc58057dbc864264ff1b0d935aede6dc863aa32f2","target":"record","created_at":"2026-06-19T16:12:23Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f54b524a441abbc6913a50455e3a86eb32815a122d0d7006569588d6fa46821e","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.SE","submitted_at":"2026-06-16T11:42:42Z","title_canon_sha256":"b0c7869fed91065eb4fc3b12fec496020b4ebb486a54110f6ec1bed2f648b0c4"},"schema_version":"1.0","source":{"id":"2606.19390","kind":"arxiv","version":1}},"canonical_sha256":"5ff2bcba04525e0308b9b014318d32f691b4812a3508da70abf4b462ce68d9fb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5ff2bcba04525e0308b9b014318d32f691b4812a3508da70abf4b462ce68d9fb","first_computed_at":"2026-06-19T16:12:23.919544Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-19T16:12:23.919544Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"UcfbBipwNmY4/6oIn9RV10hYZ1kYZByVjZT2PGtYRL1s7oln3MvX3oHCnK3EhYGHZ+NvcnTlDZSMD3js/Q82Dg==","signature_status":"signed_v1","signed_at":"2026-06-19T16:12:23.919950Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.19390","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:797b1ff0766318b77dd3a45cc58057dbc864264ff1b0d935aede6dc863aa32f2","sha256:1f1df5f7ef19b31f8633f2df670b117af67edc65c1e74f25960f79f2344655dd","sha256:0edfa00c0b09bd19f93c99b5ab401892e42284e7469ddce2147b5e878e535781"],"state_sha256":"b0ef2818ccb0513fb8df8a7deaad11094c80d4322ac383f40434451461621819"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0+5aVe6pdUbsLU/4qWh6mSUyra8VZaH74oxHIDnSMvFyOVTBNyy/pLODypY1uN2MNmpQ2L697lF6aS5LfnrLBA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-13T06:20:05.872436Z","bundle_sha256":"bcaf56621382f2b7341e25fe300d32efaf46e0500612cea2c6ba5f4c0006ced6"}}