{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2e25bd96-a572-4dc5-a25c-31b2b8a76c31",
  "version": 1,
  "metadata": {
    "timestamp": "2026-08-23T00:00:00Z",
    "component": {
      "type": "application",
      "name": "PersonaEcho Hospital Factory",
      "version": "0.3.1"
    }
  },
  "components": [
    {
      "type": "framework",
      "name": "Node.js runtime",
      "version": ">=20",
      "scope": "required"
    },
    {
      "type": "application",
      "name": "Python 3 command gateway runtime",
      "version": "HOSPITAL_PIN_REQUIRED",
      "scope": "optional"
    },
    {
      "type": "application",
      "name": "FFmpeg and ffprobe",
      "version": "HOSPITAL_PIN_REQUIRED",
      "scope": "required"
    },
    {
      "type": "application",
      "name": "Tesseract OCR with chi_tra chi_sim eng",
      "version": "HOSPITAL_PIN_REQUIRED",
      "scope": "required"
    },
    {
      "type": "application",
      "name": "Poppler pdftotext",
      "version": "HOSPITAL_PIN_REQUIRED",
      "scope": "required"
    },
    {
      "type": "application",
      "name": "ClamAV-compatible scanner and signature database",
      "version": "HOSPITAL_PIN_REQUIRED",
      "scope": "required"
    },
    {
      "type": "machine-learning-model",
      "name": "Speech analysis model",
      "version": "MODEL_LOCK_REQUIRED",
      "scope": "required"
    },
    {
      "type": "machine-learning-model",
      "name": "Speaker enrollment and verification model",
      "version": "MODEL_LOCK_REQUIRED",
      "scope": "required"
    },
    {
      "type": "machine-learning-model",
      "name": "Local language model",
      "version": "MODEL_LOCK_REQUIRED",
      "scope": "required"
    },
    {
      "type": "machine-learning-model",
      "name": "Voice build and TTS model",
      "version": "MODEL_LOCK_REQUIRED",
      "scope": "required"
    }
  ],
  "annotations": [
    {
      "subjects": [
        "urn:uuid:2e25bd96-a572-4dc5-a25c-31b2b8a76c31"
      ],
      "annotator": {
        "component": {
          "type": "application",
          "name": "PersonaEcho verification pipeline",
          "version": "0.3.1"
        }
      },
      "timestamp": "2026-08-23T00:00:00Z",
      "text": "No third-party binary, model weight or real-person source is bundled. Production requires exact local asset hashes, license-evidence hashes and active model probes."
    }
  ]
}