# Graph-40k fixture (SAMPLES-GRAPH-24-003)

Canonical large SBOM graph fixture with policy overlay for performance/regression suites.

## Contents
- `nodes.ndjson` — 40,000 component nodes (`pkg:pypi/demo-*`) for tenant `demo-tenant`.
- `edges.ndjson` — 100,071 `DEPENDS_ON` edges (fan-out ≤4, DAG order).
- `overlay.ndjson` — 100 `policy.overlay.v1` records with verdict/severity + optional edge to policy rule node.
- `manifest.json` — counts and SHA-256 hashes.
- `verify.py` — offline verifier for hashes/counts.

## Determinism
- Fixed seed `424242`, snapshot `graph-40k-policy-overlay-20251122`, timestamp `2025-11-22T00:00:00Z`.
- Sorted NDJSON rows, stable overlay ID scheme `sha256(tenant|nodeId|overlayKind)`.
- Generated via `samples/graph/scripts/generate_canonical.py` (no network access).

## Hashes (from manifest)
- nodes: `d14e8c642d1b4450d8779971da79cecc190af22fe237dee56ec0dd583f0442f5`
- edges: `143a294446f46ffa273846e821f83fd5e5023aea2cf74947ba7ccaeeab7ceba4`
- overlay: `627a0d8c273f55b2426c8c005037ef01d88324a75084ad44bd620b1330a539cc`

## Verify
```bash
cd samples/graph/graph-40k
python verify.py
```

## Regenerate (optional)
```bash
python ../scripts/generate_canonical.py --out-dir samples/graph/graph-40k
```

Ensure manifest hashes match after regeneration before promoting to offline kits.