Medical Device and SaMD Architecture

# Generate a CycloneDX SBOM for the build output
syft scan dir:./build -o cyclonedx-json > sbom.cdx.json

# Open a scratch database beside it and run the query in Panel 2
sqlite3 soup-review.db

-- Synthetic illustration: SBOM components with no SOUP evaluation on record
-- (IEC 62304 §8.1.2 identifies SOUP; the evaluation is your risk file's job).
-- Reads a CycloneDX file with the sqlite3 shell's readfile(); the evaluation
-- register is a TEMP stand-in, so nothing is written.
CREATE TEMP TABLE IF NOT EXISTS soup_evaluation (
  name TEXT NOT NULL, version TEXT NOT NULL, safety_class TEXT NOT NULL,
  evaluated_by TEXT NOT NULL, PRIMARY KEY (name, version)
);

SELECT json_extract(c.value, '$.name')    AS component,
       json_extract(c.value, '$.version') AS version,
       json_extract(c.value, '$.purl')    AS purl
FROM json_each(readfile('sbom.cdx.json'), '$.components') AS c
LEFT JOIN soup_evaluation e
       ON e.name = json_extract(c.value, '$.name')
      AND e.version = json_extract(c.value, '$.version')
WHERE e.name IS NULL
ORDER BY component;

-- Synthetic illustration: ISO 14971 risk controls with no passing
-- verification test linked to them.
CREATE TEMP TABLE IF NOT EXISTS hazard (hazard_id TEXT PRIMARY KEY, description TEXT NOT NULL);
CREATE TEMP TABLE IF NOT EXISTS risk_control (
  control_id TEXT PRIMARY KEY, hazard_id TEXT NOT NULL REFERENCES hazard(hazard_id),
  software_item TEXT NOT NULL, safety_class TEXT NOT NULL CHECK (safety_class IN ('A','B','C'))
);
CREATE TEMP TABLE IF NOT EXISTS verification_result (
  test_id TEXT NOT NULL, control_id TEXT NOT NULL REFERENCES risk_control(control_id),
  outcome TEXT NOT NULL CHECK (outcome IN ('pass','fail')), run_utc TEXT NOT NULL
);

SELECT h.hazard_id,
       rc.control_id,
       rc.software_item,
       rc.safety_class
FROM risk_control rc
JOIN hazard h ON h.hazard_id = rc.hazard_id
WHERE NOT EXISTS (
  SELECT 1 FROM verification_result v
  WHERE v.control_id = rc.control_id AND v.outcome = 'pass'
)
ORDER BY rc.safety_class DESC, h.hazard_id;