[drk-ram]

What changed

The CycloneDX and SPDX guides now match format-mapping.json, and a new test keeps them matching. The schema is the source: it carries each type mapping as data in x-acs-type-map, and the guides link it and restate it. The schema itself is corrected, because service is not a CycloneDX 1.6 component type: MCP servers, A2A peers and knowledge sources go in the top-level services array and agent_capability in compositions. skill is added to both guides.

Which issue does this implement

Closes #384

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

Specification changes

• I opened a Discussion before this PR
• Schema changes validate against the JSON Schema spec
• I described the impact on downstream implementers below

Breaking for implementers? For an implementer who followed the guides, yes, and that is the fix. Output now follows the schema: CycloneDX model is machine-learning-model (not ai-model), memory_store is data, mcp_server, a2a_peer and knowledge_source are services[] entries, agent_capability is a compositions[] entry; SPDX memory_store is dataset_DatasetPackage and agent_capability is Bundle, with CONTAINS and EXPOSES relationships. An implementer who followed the schema sees no change in meaning, except for two corrections to it:

• SPDX class names use the SPDX 3.0 JSON-LD forms (ai_AIPackage, software_Package, dataset_DatasetPackage, Bundle) instead of spdx:-prefixed names, so the schema and the guide use one spelling.
• The CycloneDX text no longer says memory_store takes a type='database' subtype or that machine-learning-model is a "bom-types extension". CycloneDX 1.6 defines neither claim.

Not changed:

• docs/acs.md still shows ai-model in two examples. [Docs] Remove SDK code and claims for packages ACS does not publish, and fix the wire examples in acs.md #267 covers that page.
• The SWID guide. It does not contradict the schema's type mapping, and the issue is about CycloneDX and SPDX.
• The SPDX guide's agent DEPENDS_ON <component> row for the root agent is gone, because the schema maps agent-level metadata to CreationInfo and defines no root relationship.

I tested this

• I synced my branch with the base branch before opening this

• uv run pytest -v passes on my machine

• uv run mkdocs build --strict passes on my machine

• uv run pytest tests/test_format_mapping_guides.py -q: 14 passed

• uv run pytest -q: 1214 passed, 10 failed, 20 errors. The failures and errors are the symlink, subprocess and timing tests in test_fetch_roadmap, test_overrides, test_pr_intake_workflow, test_publish_schemas and test_closing_choice that fail on this Windows machine without this change.

• uv run mkdocs build --strict: passes

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

[github-actions]

Thanks for this. It is queued rather than ignored. A lead has not reviewed this pull request yet. A lead will read it when they have time, and we can't promise a date. Nothing here is rejected. If a check below fails, please fix it. A pull request that waits a long time may be closed, and you can reopen it later.

[github-actions]

This pull request's description says it closes #384, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging.