docs(cli): document -C output set and distinguish it from moria's -C

README.md

@@ -76,7 +76,7 @@ Build it once either way; every scan after that is offline. See `docs/cve-join.m
 ## Scope
 
 - **secrets**: credential and key material in file content (cloud keys, tokens, JWTs, private keys, high-entropy `KEY=…` values). `/etc/shadow` and `htpasswd` hashes are classified with weak-algorithm and empty-password flags, and credential/crypto/config files are flagged by path.
-- **sbom**: components and versions from package databases, language manifests, binary version strings, libc filenames, and the kernel banner, keyed on purl (with CPE co-derived), emitted as CycloneDX and SPDX.
+- **sbom**: components and versions from package databases, language manifests, binary version strings, libc filenames, and the kernel banner, keyed on purl (with CPE co-derived). The JSON report always carries the components inline; the standard-format bills of materials (CycloneDX and SPDX) are written as `sbom.cdx.json` and `sbom.spdx.json` when you pass `-C/--outdir`.
 - **cve**: the SBOM joined against the local OSV + NVD/CPE mirror, plus the curated kernel-CVE checklist, annotated with KEV and EPSS. The default human view shows only foothold-worthy component CVEs (on CISA KEV, or Critical, or a hard High/Critical floor of CVSS >= 7.0 with EPSS traction, low attack complexity, and real impact or a trending remote DoS), sorted worst-first; it drops Mediums, local DoS, and the high-complexity crypto class. `--component-cves-full` lists them all. JSON always carries the complete set plus a `component_cve_scan` summary.
 - **licenses**: SPDX identification from `SPDX-License-Identifier` tags and LICENSE/COPYING/NOTICE text. Human output summarizes by id and count; `--license-paths` lists each license's file locations, and JSON always carries the full `paths` array.
 

mithril.1

@@ -166,8 +166,23 @@ nonzero, as in a non-interactive run. Use it in scripts and CI.
 Add user-defined detection rules from a JSON file.
 .TP
 .BR \-C ", " \-\-outdir " " \fIDIR\fR
-Write the JSON report to
-.IR DIR /mithril\-report.json .
+Also write the report to
+.IR DIR ,
+regardless of the stdout format:
+.I mithril\-report.json
+(the complete JSON result set) and, when the SBOM pass runs,
+.I sbom.cdx.json
+and
+.I sbom.spdx.json
+(the CycloneDX and SPDX bills of materials). These standard-format SBOMs are
+produced only through
+.BR \-C .
+Note that
+.BR moria (1)
+also has a
+.B \-C
+but means its extraction output directory; here it is the report output
+directory.
 .TP
 .BI \-\-threads " N"
 Worker threads for tree scans. Default: automatic.