Emit dev.kusari.mobius.meta.metadata.generated on SBOM production

[mlieberman85]

Cross-repo tracker: https://github.com/kusari-sandbox/mobius/issues/23.

Goal

When mikebom completes an SBOM generation run, emit a Mobius CloudEvent so downstream substrate consumers (bronze-translator, trace-viewer, evidence resolver) see the artifact land without polling anywhere.

Background

Flagged as a gap in kusari-sandbox/mobius audit brief:

audit/tier1-kusari/mikebom.md:112: "invocation should emit meta.metadata.generated on SBOM production"

Currently mikebom generates SBOMs and returns them to the caller; no on-substrate signal. This means every downstream consumer either polls mikebom's output directory or has to be told out-of-band that a new SBOM exists.

Event shape (per Mobius §5.1)

• type: dev.kusari.mobius.meta.metadata.generated
• source: mikebom instance URI (e.g., https://kusari.dev/mikebom/<host>)
• subject: subject digest — for a container image SBOM, sha256:<image>; for a package SBOM, sha256:<tarball>
• data:
  • subjectDigest: same as envelope subject
  • predicateType: format-specific URL (https://spdx.dev/Document for SPDX 2.3, https://spdx.dev/Document/v3 for SPDX 3, https://cyclonedx.org/bom for CycloneDX)
  • envelopeDigest: sha256 of the DSSE envelope wrapping the SBOM (if DSSE-wrapped) or of the raw SBOM bytes

Implementation options

• A (recommended for MVP): shell out to mobius-emit CLI (kusari-sandbox/mobius in-tree, see mobius#TBD). Lightest dep tree — mikebom doesn't gain a NATS client.
• B: link cloudevents/sdk-rust + async NATS client directly. Fewer moving parts at runtime; larger binary.
• C: emit via HTTP POST to mobius-emit-http shim service (kusari-sandbox/mobius#TBD).

Config: NATS_URL (or shim URL), enable flag (MOBIUS_EMIT=1), disable-mode gracefully (mikebom must still work standalone without a Mobius substrate).

Emit timing

• Emit once per (subject, predicateType) SBOM produced.
• mikebom generates CycloneDX 1.6 + SPDX 2.3 + SPDX 3.0.1 concurrently — that's 3 events per run.
• Fire-and-forget; log failures. Do NOT fail the SBOM generation on emit failure (Tenet XI — DX).

Mobius-side spec change (paired PR in kusari-sandbox/mobius)

Add mikebom to emitters: for dev.kusari.mobius.meta.metadata.generated in spec/events/registry.yaml. Update components/mikebom.yaml.

Constitution

• Tenet II: closes the shipping-today emit gap already flagged in Mobius audit.
• Tenet XI: emit must not slow SBOM generation.