Link-Not-Merge v1 Fixtures

Status: Awaiting drop (2025-11-22)

Expected contents (all JSON, canonicalized, UTF-8):

• projections.json — canonical SBOM projection payloads keyed by snapshot ID.
• assets.json — asset metadata overlays (tenant-scoped, append-only).
• paths.json — ordered dependency paths with runtime flags and blast-radius hints.
• events.json — sbom.version.created envelopes aligned to CAS/provenance fields.
• schema-version.txt — git SHA / semantic version of the frozen projection schema.
• SHA256SUMS — checksums for all files above.

Tenant ownership (SPRINT_20260712_007):

• catalog.json and component_lookup.json rows MUST carry a tenantId. The local-harness repositories (FileCatalogRepository, FileComponentLookupRepository) filter on the authenticated tenant exactly like the durable Postgres repositories, so a row without a tenantId is owned by nobody and is returned to nobody — the same fail-closed rule migration 006 applies to legacy Postgres rows.
• The rows in this drop are owned by tenant-a, which is the tenant the SbomService test harness authenticates as.

Drop instructions:

• Place files in this directory and update SHA256SUMS via sha256sum *.json *.txt > SHA256SUMS.
• Keep ordering stable; prefer NDJSON converted to JSON arrays only if deterministic sorting is applied.
• Record drop commit in sprint 0140/0142 Execution Logs and link here.

Consumers:

• SBOM-SERVICE-21-001…004 implementation and tests.
• Advisory AI and Console replay suites.
• AirGap parity review (docs/modules/sbomservice/runbooks/airgap-parity-review.md).