SBOM↔Runtime Concordance Vector (SRCV): Semantic Proof of Build Integrity for NASA JWST Science Platforms

SBOM↔Runtime Concordance Vector (SRCV): Semantic Proof of Build Integrity for NASA JWST Science Platforms introduces a verification framework that replaces brittle string-matching with semantic alignment between signed SBOMs and live runtime state. JWST science pipelines demand reproducibility and security across heterogeneous environments—from bare-metal HPC nodes to containerized services and firmware-controlled platforms. Traditional SBOM checks cannot distinguish safe drift (e.g., approved driver patches) from dangerous divergence (e.g., unsigned kernel modules, shadowed libraries, misreported firmware). SRCV addresses this by: Encoding artifacts with multi-channel embeddings (vendor/product tokens, semantic versions, signatures, hashes, paths, lineage, and runtime-only signals like loader precedence and attestation). Performing two-stage alignment: sparse K-NN + Sinkhorn soft assignment for coverage/explanation, followed by priority-ordered hard matching for crisp policy semantics. Computing an interpretable decision score with class-weighted coverage and penalties for extraneous, unsigned, or weakly anchored components. Enforcing policy-as-code gates with firmware trust tiers, runtime-only artifact allowlists, and one-click evidence diffs. Validated in NASA JWST enclaves, SRCV meets operational SLOs (p95 ≤ 3s provisioning), blocks ≥99.9% of unsigned critical components in red-team tests, and provides calibrated, auditor-ready outputs. It reframes SBOM verification as a semantic concordance problem—bringing explainability, graded assurance, and enforceable IaC security to mission-critical science platforms.