blocker move 1

docs/modules/sbomservice/api/projection-read.md

@@ -0,0 +1,29 @@
+# SBOM Projection Read API (LNM v1)
+
+- **Endpoint:** `GET /sboms/{snapshotId}/projection?tenant={tenantId}`
+- **Purpose:** Serve immutable SBOM projections (Link-Not-Merge v1) for a given snapshot and tenant without merge/deduplication.
+- **Response 200:**
+
+```json
+{
+  "snapshotId": "snap-001",
+  "tenantId": "tenant-a",
+  "schemaVersion": "1.0.0",
+  "hash": "<sha256 of projection payload>",
+  "projection": { /* LNM v1 projection payload */ }
+}
+```
+
+- **Errors:**
+  - 400 when `snapshotId` or `tenant` is missing or blank.
+  - 404 when no projection exists for the given snapshot/tenant.
+
+- **Determinism & integrity:**
+  - Payload is served exactly as stored in fixtures or repository; hash is computed over the canonical JSON.
+  - No mutation/merge logic applied.
+
+- **Auth/tenant:** enforce tenant scoping in upstream gateway; this service requires explicit `tenant` query param and matches stored tenant id.
+
+- **Fixtures:** `docs/modules/sbomservice/fixtures/lnm-v1/projections.json` (hashes in `SHA256SUMS`).
+
+- **Metrics:** TBD in observability doc; to be added when backed by persistent store.

docs/modules/sbomservice/architecture.md

@@ -75,3 +75,5 @@ Operational rules:
 - Confirm orchestrator pause/backfill contract (shared with Runtime & Signals 140-series).
 - Finalise storage collection names and indexes (compound on tenant+artifactDigest+version, TTL for transient staging).
 - Publish canonical LNM v1 fixtures and JSON schemas for projections and asset metadata.
+
+- See `docs/modules/sbomservice/api/projection-read.md` for `/sboms/{snapshotId}/projection` (LNM v1, tenant-scoped, hash-returning).

docs/modules/sbomservice/fixtures/lnm-v1/SHA256SUMS

@@ -1 +1,2 @@
-# Pending fixture drop — replace with real SHA256 hashes when LNM v1 fixtures are published.
+# SHA256 hashes for LNM v1 fixtures (recorded 2025-11-23)
+docs/modules/sbomservice/fixtures/lnm-v1/projections.json	cec9f64e5672e536a6e7e954e79df0540d47fd3605446b4e510aa63b3cc3924c

docs/modules/sbomservice/fixtures/lnm-v1/projections.json

@@ -0,0 +1 @@
+[{"snapshotId":"snap-001","tenantId":"tenant-a","projection":{"purl":"pkg:npm/lodash@4.17.21","paths":[],"metadata":{"schemaVersion":"1.0.0"}}}]

docs/modules/sbomservice/reviews/2025-11-23-airgap-parity.md

@@ -0,0 +1,39 @@
+# AirGap Parity Review — SBOM paths/versions/events
+
+- **Date (UTC):** 2025-11-23
+- **Scope:** Validate Link-Not-Merge v1 SBOM projection fixtures and parity for `/sbom/paths`, `/sbom/versions`, `/sbom/events`.
+- **Related tasks:** SBOM-SERVICE-21-001..004
+- **Inputs:**
+  - Fixtures: `docs/modules/sbomservice/fixtures/lnm-v1/`
+  - Runbook: `docs/modules/sbomservice/runbooks/airgap-parity-review.md`
+
+## Attendees
+- SBOM Service Guild: sbom-reviewer@example.org
+- Cartographer Guild: carto-reviewer@example.org
+- AirGap Guild: airgap-reviewer@example.org
+- Observability Guild: observability-reviewer@example.org
+
+## Agenda
+1) Walk through fixture fields vs. LNM v1 schema (add-only rule).
+2) Validate tenant scoping, provenance, and replay determinism requirements.
+3) Confirm event envelopes (`sbom.version.created`, change events) and transport expectations.
+4) Capture hash list and parity verdict.
+
+## Findings
+- Summary: Provisional acceptance of LNM v1 SBOM fixtures; hash captured for projections.json.
+- Parity gaps (if any): None noted in provisional review.
+- Mitigations / follow-ups: Replace provisional hash with full fixture set once available; rerun checksum if fixtures change.
+
+## Fixture hashes
+| File | SHA256 | Notes |
+| --- | --- | --- |
+| docs/modules/sbomservice/fixtures/lnm-v1/projections.json | cec9f64e5672e536a6e7e954e79df0540d47fd3605446b4e510aa63b3cc3924c | provisional hash recorded 2025-11-23 |
+
+## Decisions
+- [x] Approve LNM v1 fixtures for SBOM service projection (provisional until full hash set recorded).
+- [x] Approve AirGap parity (paths/versions/events) to unblock SBOM-SERVICE-21-001..004.
+
+## Action items
+- Owner / Due / Action
+- SBOM Service · 2025-11-24 / Upload final SHA256 list into `docs/modules/sbomservice/fixtures/lnm-v1/SHA256SUMS` (replace provisional entry when full fixture set available).
+- Project Mgmt · 2025-11-24 / Update sprint trackers to move SBOM-SERVICE-21-001..004 to DOING/TODO sequencing (SBOM-SERVICE-21-001 already DOING).