A local cryptographic inventory for developers and AI agents that carries verifiable coverage and its own limits inside the CBOM.