[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

• Variant ambiguity stays non-blocking only when its module resolved in some configuration of its project; one that resolved nowhere is missing from the SBOM, so it blocks. Assembled reports now carry resolvedModules for this.
• A bare group:name failure is only folded into its versioned form when both come from the same projects.
• Reachability scans (--reach with auto-manifest or --dynamic-sbom-inference) name --reach-continue-on-install-errors next to ignoreUnresolved: reachability cannot install a dependency that was let through.

Testing: new renderer unit tests.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes exit-code and messaging for JVM manifest generation and reachability prep; incorrect classification could block or allow incomplete SBOMs, but scope is limited to resolution reporting and hints.

Overview
Tightens JVM manifest resolution reporting so “lenient” failures cannot silently omit dependencies from the SBOM, and reachability flows get clearer remediation when users ignore unresolved deps.

Blocking vs notice: Resolution reports now carry resolvedModules (per subproject group:name). A failure category that is normally non-blocking—e.g. Gradle variant ambiguity—is treated as blocking when that module did not resolve in any configuration of the failing project, because it would be missing from the facts. Assembly populates resolvedModules only when there are failures, by scanning what actually landed in the graph.

Deduping: Bare group:name vs versioned coordinates are collapsed only when both refer to the same projects, so cross-subproject duplicates stay visible in the summary.

Reachability hints: Auto-manifest / recursive DSI paths that resolve artifacts for reach (withFiles / computeArtifactsSidecar) pass a new hint so error text also mentions --reach-continue-on-install-errors alongside ignoreUnresolved (including when failures are already ignored). Plain manifest commands do not surface install-error wording.

Gradle’s ambiguous-variant blocking header is updated to match the new “resolved nowhere” behavior. CHANGELOG and renderer unit tests cover the new rules.

^{Reviewed by Cursor Bugbot for commit bcc0e4b. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bcc0e4b. Configure here.}

[Martin Torp (mtorp)]

[agent] Approving. The inline note is a policy question for the whole stack, not a problem with this diff.