taleodor

Check ReARM we're building for durable tracking of releases, software updates and fulfilling 10+ years obligations - https://rearmhq.com

Small and cheap cloud VM, preferably on a separate account used for this purpose specifically.

This is more about understanding the big picture and architecture of what's going on (the part about the diagrams / blueprints). One practical thing actually that may be useful to you - try thinking and testing in terms of "what can go wrong" rather than "is this prod-ready".

If you're planning to put it into production anything you do outside of bringing somebody qualified at this point is likely a waste of time. Highly recommend this recent talk by Kelsey Hightower on the subject - https://www.youtube.com/watch?v=A7WFt2JQ5sg

Full CRA requirements kick in in December 2027. Reporting obligations kick in in September 2026. Would probably make sense to update the website timer to reflect December 2027 deadline which is more relevant here.

Did you try working with CycloneDX AI/ML BOM group? This would be good place to contribute.

We support this with ReARM - https://rearmhq.com/

It's an open-core product (there is an option to self-host FOSS ReARM CE yourself) that gives you per-release vulnerability posture. It consumes various artifacts (e.g., SBOMs) generated during CI phase and does scan on them, doesn't need access to source code. Apart from SBOMs it consumes files with findings from other tools (reports in SARIF format, VDRs, VEXs).

Very cool, we're doing similar except we let agents open PRs as well + we track release metadata and agentic sessions via our ReARM system + we've recently launched an option for agents to track helm-based deployments via ReARM - https://docs.rearmhq.com/workflows/devops.html

It's not about that we should drop LLM completely from the mix, but something like AI -> LLM control -> old-school classifier control -> script / human oversight is the way. If something has potential to cause millions in damages, it should be subjected to human oversight (likelihood / impact analysis needs to happen early in the system design).

Frankly I don't buy atrophy argument at all. I (and I believe many other people) switched multiple frameworks and languages over the years. I.e., I was an expert in Chef more than 10 years ago, and nowadays I hardly remember anything about it. Calling this a cognitive decline is a significant stretch.

If you're afraid of cognitive decline - try to get to proper orchestration using multiple agents. That's a fun exercise.