test: update smoke golden files - #13

…413)

* docs: ADR-0041 — identity is the canonical PURL on typed graph nodes

Supersedes ADR-0036 after review of the first implementation round
(bomly-sdk PRs #13–#15, closed unmerged): the bespoke identity surface —
coordinate-fallback grammar, hashed occurrence suffixes, and the 128-bit
content address — attracted every hardening round and served no consumer.
Identity becomes the canonical PURL on a typed node union (PackageNode
requires a valid PURL, type+name mandatory with missing versions warned;
ManifestNode is structural), the occurrence qualifier is the existing
normalized origin, comparison is an equals/key pair, and contradicting
occurrences get deterministic run-local ordinals. The wire keeps the flat
node shape plus an additive kind discriminator. Plan item 1.3 rescoped.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — three-kind node union, PURL-spec validity, sealed contracts

The union grows to what the CLI actually models, in reviewer-directed
vocabulary: manifest, module (the project's own root and workspace
artifacts — first-party ownership becomes the kind, not a boolean), and
dependency nodes, with both project shapes (manifest→module→dependencies
and nested workspace manifests) as plain edge patterns. Dependency-node
validity delegates entirely to the PURL specification via packageurl-go —
scheme+type+name plus each type's own rules — with missing versions warned
as the one Bomly policy. The identity relation is now kind-scoped with the
ADR-0033 three-way origin rule (equal folds, gap fills, different
coexists), which also makes cross-kind folds impossible by construction.
Specified: the identity-form qualifier gate for published IDs, ordinal
start/scope/order, and the wire kind discriminator (authoritative when
present, deterministic legacy inference, unknown = decode error, four
frozen fixtures). Every remaining ADR-0036 identity reference in
SDK_MATURITY_PLAN.md is rescoped.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — qualifiers are identity, gaps stay distinct, suffixes hash the origin

Three reviewer-directed corrections. Qualifiers stay in published IDs —
the PURL spec defines them as qualifying data and container scans carry
one package/version under two architectures — with only the spec's
URL-valued evidence keys (repository_url, download_url, vcs_url) stripped
to Origin behind the ADR-0033 gates. An unknown origin is its own
occurrence, never a gap consolidation fills (manufacturing provenance);
ecosystem detectors may fill gaps at detection time where their semantics
justify it. Occurrence suffixes derive from a short hash of the
occurrence's own normalized origin, stable under occurrence-set changes
where positional ordinals would renumber published bom-refs; run-local
ordinals remain only for the rare raw-evidence-only contradictions, with
the run-scoped caveat stated.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — origin gates named, module identity path-scoped, ref semantics industry-aligned

Evidence-qualifier redirection is defined as passing through the ADR-0033
origin constructors, which reject signed or tokenized links outright —
nothing is sanitized into publication. Module identity always includes the
declaring manifest path, so a recursive scan's two unrelated same-name
projects can never fold. Readable-ID stability is scoped the way the major
SBOM formats scope it: CycloneDX bom-refs and SPDX element IDs are
document-local handles, cross-run identity lives in the data fields, and
the singleton-keeps-bare-PURL choice is recorded with the rejected
alternative. The architecture narrative now points at ADR-0041.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: simplify — origin is metadata, identity is the PURL alone

The maintainer's usefulness-over-complexity review lands: the occurrence
machinery served a same-manifest multi-source corner resolvers do not
produce, and every other SCA model (GitHub, Syft, Snyk, CycloneDX
evidence.occurrences) treats origin as evidence on one identity.
Dependency nodes now carry an Origins list, union-merged and never an
identity term; suffixes, ordinals, ephemeral discriminators, contradiction
finalization, and the origin comparison term are all deleted from the
design; node IDs are the canonical PURL itself, unique by construction.
Cross-manifest attribution stays with the per-entry graphs, a multi-origin
list becomes a displayable dependency-confusion signal, and ADR-0033 is
narrowed to its publication gates. Plan references rescoped.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — spec-known qualifiers, canonical paths, format projections, edge-union recorded

Identity qualifiers narrow to the specification's known keys (registered
plus type-documented; unrecognized custom keys drop with a warning — an
imported document can invent a token-bearing qualifier, and IDs are
published); ADR-0033 gains the amendment note recording that the artifact
form rejects query-carrying URLs rather than stripping them. Module
fallback identity is consistently declaring-manifest-path plus name, all
identity paths are canonical repository-relative slash-separated forms
enforced by SDK constructors, and path-based IDs render kind-qualified so
a PURL-less module and its declaring manifest never share a published ID.
Reference semantics are format-aware: bom-ref carries the PURL directly,
SPDX keeps its idstring projection with collision mapping as a
format-local rendering. Dual origin/origins payloads decode as a
deduplicated union with a pinned fixture. The PURL-fold edge-union
trade-off is recorded as a deliberate consequence with its test-expectation
change named.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — application type is not an ownership signal in kind inference

Legacy payloads infer module only from the first-party marker; an
application-typed component without it stays a dependency node, matchable
and enrichable, per ADR-0015 — inferring ownership from the type would
silently exempt imported SBOM applications from matching and hide their
vulnerabilities.

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs: address review — eligibility folds toward eligible, qualifier stripping relocates the Scorecard signal

Registry-match eligibility becomes node-level with an any-witness rule
when occurrences fold (withholding enrichment would hide vulnerabilities;
the reverse merely enriches a PURL the registry also serves) — recorded as
a narrowing of ADR-0015, with per-source observations kept in the origins
list. Qualifier stripping is defined as relocation, not deletion: the
Scorecard matcher's repository resolution reads exactly these keys today,
so it receives the vetted origin signal projected onto the match request,
and the plan marks its adoption bump as behavioral rather than mechanical.

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Claude Fable 5 <[email protected]>