docs(website): publish CycloneDX AI-BOM export in Govern tutorial

packages/website/src/pages/docs/dependencies.astro

@@ -42,6 +42,9 @@ import DocsLayout from '../../layouts/DocsLayout.astro';
   <p>
     For the engineering story behind this design, read
     <a href="/blog/dependency-intelligence">Dependency Intelligence: How Skillsmith Infers What Your Skills Need</a>.
+    To export this dependency graph as a standard SBOM, see the Govern tutorial's
+    <a href="/docs/tutorials/govern#cyclonedx-export">CycloneDX AI-BOM export step</a>
+    (Team+).
   </p>
 
   <h2>Declaring Dependencies</h2>
@@ -434,7 +437,6 @@ dependencies:
     <li><strong>Co-install inference</strong>: The <code>inferred_coinstall</code> source exists in the schema but is not yet populated</li>
     <li><strong>Semver range validation</strong>: Version constraints are stored but not enforced at install time</li>
     <li><strong>No automatic resolution</strong>: Skillsmith never installs dependencies on your behalf</li>
-    <li><strong>No CycloneDX AI-BOM export</strong>: Dependency data is not yet exportable in standard SBOM formats</li>
     <li><strong>No dependency_policy configuration</strong>: You cannot configure per-project dependency rules</li>
   </ul>
 
@@ -445,6 +447,7 @@ dependencies:
     <li><a href="/docs/mcp-server">MCP Server</a> — full MCP tool reference</li>
     <li><a href="/docs/security">Security</a> — security scanning and advisories</li>
     <li><a href="/docs/trust-tiers">Trust Tiers</a> — trust tier definitions</li>
+    <li><a href="/docs/tutorials/govern">Govern Tutorial</a> — CycloneDX AI-BOM export, audit logs, SIEM</li>
     <li><a href="/blog/dependency-intelligence">Dependency Intelligence</a> — engineering deep-dive blog post</li>
   </ul>
 </DocsLayout>

packages/website/src/pages/docs/mcp-server.astro

@@ -506,7 +506,7 @@ Assistant: [Uses compare tool] Here's a comparison:
     <li><a href="/docs/tutorials/evaluate"><strong>Evaluate</strong></a> — <code>get_skill</code>, <code>skill_compare</code>, <code>skill_diff</code></li>
     <li><a href="/docs/tutorials/install-and-use"><strong>Install &amp; use</strong></a> — <code>install_skill</code>, <code>skill_validate</code></li>
     <li><a href="/docs/tutorials/maintain"><strong>Maintain</strong></a> — <code>skill_updates</code>, <code>skill_outdated</code>, <code>skill_inventory_audit</code> (Team+)</li>
-    <li><a href="/docs/tutorials/govern"><strong>Govern</strong></a> — <code>skill_audit</code> (Team+), <code>audit_export</code>, <code>audit_query</code>, <code>siem_export</code> (Enterprise)</li>
+    <li><a href="/docs/tutorials/govern"><strong>Govern</strong></a> — <code>skill_audit</code>, <code>compliance_report</code> (Team+), <code>audit_export</code>, <code>audit_query</code>, <code>siem_export</code> (Enterprise)</li>
     <li><a href="/docs/tutorials/retire"><strong>Retire</strong></a> — <code>uninstall_skill</code></li>
     <li><a href="/docs/inventory"><strong>Cross-machine skill inventory</strong></a> — view installed skills across devices</li>
   </ul>

packages/website/src/pages/docs/tutorials/govern.astro

@@ -29,6 +29,7 @@ import DocsLayout from '../../../layouts/DocsLayout.astro'
     <li>Stream events to a SIEM (Splunk, Elastic, Datadog)</li>
     <li>Run skill-level and pack-level security audits</li>
     <li>Read the session-start governance summary at the start of every Claude Code session</li>
+    <li>Export a CycloneDX AI-BOM for compliance evidence</li>
   </ul>
 
   <h2>Tools that map to Govern</h2>
@@ -73,6 +74,12 @@ import DocsLayout from '../../../layouts/DocsLayout.astro'
         <td>Export audit events for SIEM ingestion (CEF / LEEF / JSON)</td>
         <td>Enterprise</td>
       </tr>
+      <tr>
+        <td>MCP</td>
+        <td><code>compliance_report</code></td>
+        <td>Generate SOC 2, CycloneDX AI-BOM, or JSON compliance reports</td>
+        <td>Team+</td>
+      </tr>
       <tr>
         <td>CLI</td>
         <td><code>skillsmith audit advisories</code></td>
@@ -244,6 +251,54 @@ skillsmith audit advisories --all   # Audit every installed skill`}</code></pre>
     <code>confirmed: true</code> to actually write the change.
   </p>
 
+  <h2 id="cyclonedx-export">Step 8 — Export a CycloneDX AI-BOM for compliance evidence</h2>
+
+  <p>
+    Regulatory and procurement obligations — EU AI Act technical-documentation requirements (Article
+    11 / Annex IV, for systems in the Annex III high-risk categories) and SBOM expectations flowing
+    from US EO 14028 and its implementing OMB guidance — increasingly call for a machine-readable
+    bill of materials, not just an audit log. <code>compliance_report</code> covers this: call it
+    with <code>format: "cyclonedx"</code> to get a CycloneDX 1.5 AI/ML-BOM document of your installed
+    skills, inferred dependencies, MCP server dependencies, and model requirements. The same tool
+    also supports <code>format: "soc2"</code> and <code>format: "json"</code> for other compliance
+    workflows.
+  </p>
+
+  <p><strong>Try this prompt:</strong></p>
+
+  <ul>
+    <li>"Generate a CycloneDX AI-BOM for my installed skills"</li>
+  </ul>
+
+  <p>
+    If your machine hasn't run <code>skill_rescan</code> recently, the export legitimately comes back
+    with <code>dependencyDataSource: "pending-rescan"</code> for some or all skills — the dependency
+    graph hasn't been extracted yet, not a bug. Pass <code>backfillDependencies: true</code> on the
+    same call to trigger that extraction inline during export instead of running
+    <code>skill_rescan</code> separately first; this only takes effect on the native
+    <code>better-sqlite3</code> driver, not the WASM <code>sql.js</code> fallback some installs use.
+    A mix of rescanned and not-yet-rescanned skills produces <code>dependencyDataSource: "partial"</code>
+    — also expected, not an error.
+  </p>
+
+  <p>
+    Validate the output against the CycloneDX 1.5 JSON schema with
+    <code>@cyclonedx/cyclonedx-library</code>'s <code>Validation.JsonStrictValidator</code> (the same
+    library Skillsmith validates with internally) or the official web validator at
+    <a href="https://cyclonedx.org/">cyclonedx.org</a>.
+  </p>
+
+  <div class="callout warning">
+    <p class="callout-heading">Newly launched, not yet validated at scale</p>
+    <p>
+      The CycloneDX AI-BOM export is a new capability. Every generated BOM carries a
+      <code>skillsmith:notice</code> metadata property saying so until design-partner UAT concludes.
+      Review output before relying on it for a regulatory submission, and note that v1 does not
+      include license, vulnerability (VEX), or provenance fields, and does not redact locally-authored
+      or proprietary skills from the export.
+    </p>
+  </div>
+
   <h2>Common pitfalls</h2>
 
   <h3>"License required" on every Govern call</h3>

packages/website/src/pages/pricing.astro

@@ -274,6 +274,13 @@ const jsonLdData = generateJsonLd(pricingTiers, pricingFaqs)
             <td class="highlighted"><span class="dash" aria-label="No">&mdash;</span></td>
             <td><span class="roadmap" aria-label="On roadmap">&#128336;</span></td>
           </tr>
+          <tr>
+            <td>Compliance Reports (SOC 2 / CycloneDX AI-BOM)</td>
+            <td><span class="dash" aria-label="No">&mdash;</span></td>
+            <td><span class="dash" aria-label="No">&mdash;</span></td>
+            <td class="highlighted"><span class="check" aria-label="Yes">&#10003;</span></td>
+            <td><span class="check" aria-label="Yes">&#10003;</span></td>
+          </tr>
           <tr>
             <td>SLA Guarantee</td>
             <td><span class="dash" aria-label="No">&mdash;</span></td>
@@ -315,7 +322,6 @@ const jsonLdData = generateJsonLd(pricingTiers, pricingFaqs)
           <li>Role-based access control</li>
           <li>Audit logging (MCP tools)</li>
           <li>SIEM export</li>
-          <li>Compliance reports</li>
           <li>Custom integrations</li>
           <li>Private skill registry</li>
         </ul>