Issues

• Web: SBOM/VEX inputs on the scan form (follow-up to S5)

  enhancement
  FootprintAI/touchstone#32 · Filter by author hsinatfootprintai opened on Oct 26, 2026

• [W2] Add docs/README.md: an index of the documents under docs/

  agent:doneagent:readyruntime:claudesize:S
  FootprintAI/touchstone#24 · Filter by author hsinatfootprintai opened on Oct 23, 2026
  2

• [W1] Reconcile docs/architecture/touchstone.md with what S0 shipped

  agent:doneagent:readyruntime:claudesize:S
  FootprintAI/touchstone#22 · Filter by author hsinatfootprintai opened on Oct 23, 2026
  2

• [W0] Add docs/glossary.md: evidence and confidence terms

  agent:doneagent:readyruntime:claudesize:S
  FootprintAI/touchstone#18 · Filter by author hsinatfootprintai opened on Oct 23, 2026
  2

• Sprint 2026-W44: passive URL scan works end-to-end (CLI + web)

  epicsprint
  FootprintAI/touchstone#17 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• [S7] Fingerprint complete: Retire.js filecontent/hashes via regexp2 with timeout, header CPE table, backport caveat

  agent:doneagent:readyenhancementphase-2-optimizeruntime:claudesize:M
  FootprintAI/touchstone#15 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  6

• [S6] Repo scan: forge latest-release resolution, tarball fetch, osv-scalibr lockfile extraction

  enhancementneeds-verificationphase-2-optimizeruntime:claudesize:M
  FootprintAI/touchstone#14 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer-supplied SBOM/VEX

  agent:doneagent:readyenhancementneeds-verificationphase-2-optimizeruntime:claudesize:M
  FootprintAI/touchstone#13 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  6

• [S4] SBOM/VEX parsers: CycloneDX, SPDX, OpenVEX, CycloneDX VEX, CSAF VEX, with VEX applied in vuln

  enhancementphase-2-optimizeruntime:claudesize:L
  FootprintAI/touchstone#12 · Filter by author hsinatfootprintai opened on Oct 22, 2026

• [S3] Vulnerability matching: NVD CPE fallback, KEV and EPSS enrichment, ranking, lookup_status

  agent:doneagent:readyenhancementneeds-verificationphase-2-optimizeruntime:claudesize:M
  FootprintAI/touchstone#11 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  4

• [S10] Docker image, compose with fixture-vendor, e2e: CLI = web JSON and request log ⊆ allowed set

  ciphase-1-flowruntime:claudesize:M
  FootprintAI/touchstone#10 · Filter by author hsinatfootprintai opened on Oct 22, 2026

• [S9] Web page: Next.js static export with URL input and report view, served by touchstone serve

  agent:doneagent:readyenhancementneeds-verificationphase-1-flowruntime:claudesize:M
  FootprintAI/touchstone#9 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  14

• Report: web page and CLI on one engine, Markdown and versioned JSON export

  enhancementproductruntime:claudesize:L
  FootprintAI/touchstone#5 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• Passive fingerprint fallback with Low-confidence labelling and evidence

  enhancementproductruntime:claudesize:L
  FootprintAI/touchstone#4 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• Scan the vendor's public source repo at its latest release when no SBOM is published

  enhancementproductruntime:claudesize:M
  FootprintAI/touchstone#3 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• Match components to CVEs via OSV/NVD, honor VEX, rank by KEV and EPSS

  enhancementproductruntime:claudesize:M
  FootprintAI/touchstone#2 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  1

• Discover vendor-published SBOM, VEX and source-repo links from a URL

  enhancementproductruntime:claudesize:L
  FootprintAI/touchstone#1 · Filter by author hsinatfootprintai opened on Oct 22, 2026
  2