nuget reorganization

samples/graph/fixtures-plan.md

@@ -0,0 +1,34 @@
+# Graph Fixtures Plan (SAMPLES-GRAPH-24-003)
+
+## Goals
+- Produce a deterministic large-scale SBOM graph fixture (~40k nodes) with policy overlay snapshot for perf/regression suites (UI/CLI/Graph API).
+- Align with current graph node/edge schema and overlay format used by `StellaOps.Graph.Indexer` and Vulnerability Explorer.
+- Ensure offline parity: fixtures packaged for Offline Kit consumption (NDJSON + manifest hashes).
+
+## Assumptions / Pending confirmations
+- Overlay format: waiting on Graph Guild decision (checkpoint 2025-11-22) regarding overlay fields and snapshot manifest layout.
+- SBOM bundle source: use scanner surface mock bundle v1 unless real caches land; confirm with Graph Guild.
+- Tenant: default to `demo-tenant` unless advised otherwise; all IDs and timestamps must be deterministic.
+
+## Proposed fixture contents
+- `nodes.ndjson`: ~40k nodes; sorted by id; includes artifact, package, relationship nodes.
+- `edges.ndjson`: matching edges; sorted by id.
+- `overlays/policy.ndjson`: policy overlay snapshot aligned with chosen overlay schema.
+- `manifest.json`: hashes (SHA-256) of all files plus counts; UTC timestamps rounded to seconds.
+- `README.md`: execution + verification steps, expected counts/hashes.
+
+## Generation sketch
+1) Start from existing mock SBOM bundle (scanner surface v1); sample driver script will:
+   - deterministically seed random generators;
+   - produce nodes/edges via Graph Indexer schema helpers;
+   - emit overlays using placeholder policy verdicts (allow/deny/defer) until final schema confirmed.
+2) Write NDJSON with stable ordering; compute SHA-256 for each file; write manifest.
+3) Run validation script to assert counts, schema shape, and hash reproducibility.
+
+## Open items (to resolve before data generation)
+- Confirm overlay field set and file naming (Graph Guild, due 2025-11-22).
+- Confirm allowed mock SBOM source list and artifact naming (Graph Guild / SBOM Service Guild).
+- Provide expected node/edge cardinality breakdown (packages vs files vs relationships) to guide generation.
+
+## Next steps
+- Blocked pending overlay/schema confirmation; revisit after 2025-11-22 checkpoint.

samples/graph/scripts/generate-fixture-plan.md

@@ -0,0 +1,18 @@
+# Generation driver (stub) — SAMPLES-GRAPH-24-003
+
+> Blocked: overlay schema + mock SBOM bundle list pending. Script outline only.
+
+## Outline
+1) Input bundle(s): scanner surface mock bundle v1 (or real caches when available).
+2) Deterministic seeding: `RANDOM_SEED=424242`; time source frozen at `2025-11-22T00:00:00Z`.
+3) Steps (once unblocked):
+   - Parse SBOM mock bundle, expand to node/edge sets following Graph schema.
+   - Generate policy overlay snapshot with placeholder verdicts until final fields confirmed.
+   - Write NDJSON (`nodes.ndjson`, `edges.ndjson`, `overlays/policy.ndjson`) sorted by `id`.
+   - Emit `manifest.json` with SHA-256, counts, timestamps.
+   - Add `verify.sh` to recompute hashes and validate counts.
+
+## TODO when unblocked
+- Fill overlay field mapping once Graph Guild confirms schema (checkpoint 2025-11-22).
+- Confirm allowed mock SBOM source list with SBOM / Graph guilds.
+- Implement generator script in Python or C# (deterministic ordering, no network access).