Landing software supply chain security: the SBOM, VEX, and gate-blocking trilogy

From inventory to waivers to enforcement: a complete rollout path for SBOM generation, VEX false-positive governance, and autoBlock download blocking — at a gradual pace that won't make developers hate security.