audit‑ready: Deterministic, Audit‑Ready npm Vulnerability Scanning with CycloneDX SBOM

The audit‑ready tool transforms npm audit output into deterministic, audit‑ready decisions by replacing CVSS with a reasonCode that assigns each dependency one of six labels: DEV_DEPENDENCY_ONLY, OPTIONAL_DEPENDENCY, TRANSITIVE_NO_EXPLOIT, DIRECT_UNPATCHED, NO_KNOWN_VULNERABILITY, and EXEMPTED. A CI‑friendly command, `npx audit-ready scan --fail-on DIRECT_UNPATCHED`, exits with code 0 when no direct unpatched vulnerabilities exist and 1 when they do, providing a clear, enforceable rule. The engine enforces strict constraints—no Date, Math.random, process.env, or I/O—ensuring that the same package‑lock.json always produces identical output. Output formats include CycloneDX 1.5 SBOM, a human‑readable report, and SARIF for GitHub Security, all tied to the reasonCode.

Audit‑ready also guarantees reproducibility by generating deterministic PURLs, validating schemas before writing, and freezing all models to prevent silent mutation. It performs a self‑audit via `audit-ready audit-self` to expose any internal inconsistencies, and only contacts the OSV API for vulnerability data, exiting with code 2 if the call fails. The tool is currently in Phase 1 (SBOM + triage) and Phase 2 (policy + exceptions), with caching and performance improvements slated for Phase 3 and a production release thereafter. The author invites feedback on edge cases, incorrect classifications, and monorepo support, emphasizing that predictability beats intelligence in security tooling.