Resolve the selected UI profile once into a Maven CycloneDX graph and fail closed when Trivy or OSV omits packages or returns malformed evidence. Keep existing vulnerability and malicious-package gates. Co-authored-by: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>