Describe the tool as software composition analysis, not supply chain analysis

[richardmhope]

"Supply chain analysis" oversold what this does. It inventories declared third-party components and checks them against OSV — software composition analysis. It does not look at build provenance, signatures, or what a downloaded artefact actually contains, and the docs should not suggest otherwise.

Terminology

Renamed the category everywhere it describes the tool:

• README.md intro
• website hero eyebrow and site_description in zensical.toml
• pyproject.toml description, plus software-composition-analysis and dependency-scanning keywords
• the package docstring and icebergsca --help
• CLAUDE.md
• the bundled agent skill — both its frontmatter description (which is what agents select on) and its body

Left "supply chain" where it names a genuine risk rather than the product category: not shelling out to mvn, hand-writing ranges/SARIF/CycloneDX instead of taking dependencies, the CI comments about this repo's own pipeline, and the SARIF supply-chain rule tag. Those statements are still accurate.

Wordmark

icebergsca-horizontal.svg now reads "Software composition analysis". Letter-spacing drops from 2.5 to 1.8 to fit the longer string. Measured in headless Chromium: the subtitle is 279.1px wide against the wordmark's 279.1px, so it sits flush with the text above rather than overflowing the 660px viewBox.

Scope note

Since the rename narrows the claim, the boundary is now stated explicitly in the README and How it works rather than left implied — it identifies a package by name and version, so provenance, signatures and typosquats are outside what a report can speak to.

Tone

Dropped the "Find. Resolve. Check. Report." slogan. Retitled sections to say what they contain:

Before	After
The one rule	What an empty findings list means
Built to be scanned as well as to scan	The tool's own dependencies
Real dependency graphs	Transitive dependency graphs
Findings never fail your build	Findings never change the exit code
The part that matters	Before reporting a project clean
Caveats worth knowing	Caveats

Trimmed flourishes like "matters more than it looks", "gets || true appended within a week" and "and — most importantly —". The CI workflow examples are renamed from name: Supply chain to name: Dependency scan. No technical content was removed.

Verification

ruff check, ruff format --check, mypy and pytest (384 passed) all pass. The Zensical site builds clean (No issues found) and the rendered index.html carries the new wording. Checked that nothing links to the renamed heading anchors.

Two caveats worth flagging: the dogfood icebergsca scan . could not reach OSV from the sandbox (api.osv.dev returns 403 through the agent proxy), so that path is unverified — though the tool responded correctly by reporting "No packages could be checked — this is not a clean result" rather than a false clean. And there is no CHANGELOG entry, since everything under [Unreleased] describes the unshipped 0.1.0 and wording changes to it would be noise; happy to add one if you'd prefer.

---

Generated by Claude Code