FDA-STAT-002 error

The SBOM enumerates commercial, open-source and off-the-shelf components

Pack fda-524b 1.0.0

Severity: error
The statute names all three categories explicitly. An SBOM that lists only the manufacturer's own code is not the artifact the statute asks for, and its absence is a statutory gap rather than a quality problem.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Enumerate every component including purchased and licensed software, open source, and off-the-shelf software, not only first-party code.
Source: fdc-524b: Section 524B(b)(3), 21 USC 360n-2(b)(3)
Note: STATUTORY. Counting is a weak proxy for the real requirement; a human still has to confirm the categories are actually represented.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-STAT-002 --pack fda-524b prints this page.