Graph-40k fixture (SAMPLES-GRAPH-24-003)

Canonical large SBOM graph fixture with policy overlay for performance/regression suites.

Contents

• nodes.ndjson — 40,000 component nodes (pkg:pypi/demo-*) for tenant demo-tenant.
• edges.ndjson — 100,071 DEPENDS_ON edges (fan-out ≤4, DAG order).
• overlay.ndjson — 100 policy.overlay.v1 records with verdict/severity + optional edge to policy rule node.
• manifest.json — counts and SHA-256 hashes.
• verify.py — offline verifier for hashes/counts.

Determinism

• Fixed seed 424242, snapshot graph-40k-policy-overlay-20251122, timestamp 2025-11-22T00:00:00Z.
• Sorted NDJSON rows, stable overlay ID scheme sha256(tenant|nodeId|overlayKind).
• Generated via docs/samples/graph/scripts/generate_canonical.py (no network access).

Hashes (from manifest)

• nodes: d14e8c642d1b4450d8779971da79cecc190af22fe237dee56ec0dd583f0442f5
• edges: 143a294446f46ffa273846e821f83fd5e5023aea2cf74947ba7ccaeeab7ceba4
• overlay: 627a0d8c273f55b2426c8c005037ef01d88324a75084ad44bd620b1330a539cc

Verify

cd docs/samples/graph/graph-40k
python verify.py

Regenerate (optional)

python ../scripts/generate_canonical.py --out-dir docs/samples/graph/graph-40k

Ensure manifest hashes match after regeneration before promoting to offline kits.