{
  "tool_id": "art-386-lint-cbom-structure",
  "note": "golden_hash empty until first `node golden-parity.test.mjs --update`.",
  "vectors": [
    {
      "name": "default-inputs",
      "policy_parameters": {},
      "output_payload": {
        "verdict": "INVALID_CBOM",
        "data_version": "cnsa2-targets-2026-07-18",
        "cbom_structurally_valid": false,
        "structural_issues": [],
        "total_components": 4,
        "total_algorithm_assets": 4,
        "vulnerable_count": 2,
        "cnsa2_ready_count": 1,
        "unclassified_count": 0,
        "structurally_invalid_count": 1,
        "findings": [
          {
            "index": 0,
            "name": "RSA-2048",
            "primitive": "signature",
            "parameter_set_identifier": "2048",
            "status": "STRUCTURAL_VALID",
            "classification": "asserted:quantum_vulnerable",
            "matched_pattern": "RSA"
          },
          {
            "index": 1,
            "name": "ML-KEM-1024",
            "primitive": "key-encapsulation",
            "parameter_set_identifier": "ML-KEM-1024",
            "status": "STRUCTURAL_VALID",
            "classification": "asserted:cnsa2_ready",
            "matched_pattern": "ML-KEM-1024"
          },
          {
            "index": 2,
            "name": "SHA-1",
            "primitive": "hash",
            "parameter_set_identifier": "SHA-1",
            "status": "STRUCTURAL_VALID",
            "classification": "asserted:quantum_vulnerable",
            "matched_pattern": "SHA-1"
          },
          {
            "index": 3,
            "name": "AES-256-GCM",
            "status": "STRUCTURAL_INVALID",
            "missing_fields": [
              "cryptoProperties.algorithmProperties.certificationLevel"
            ],
            "classification": "asserted:unclassified"
          }
        ],
        "compliance_flags": [
          "STRUCTURAL_LINT_ONLY_NOT_A_SCANNER",
          "CBOM_STRUCTURAL_ISSUES_FOUND",
          "QUANTUM_VULNERABLE_PRIMITIVES_ASSERTED"
        ]
      },
      "golden_hash": "20e02c9599c7bf48ec3d63f8cd71d8eb4aa3d547560e6dea0b337b404ce34f1a"
    },
    {
      "name": "not-valid-json",
      "policy_parameters": {
        "cbom": "{not json"
      },
      "output_payload": {
        "verdict": "INVALID_CBOM",
        "data_version": "cnsa2-targets-2026-07-18",
        "cbom_structurally_valid": false,
        "structural_issues": [
          "CBOM_NOT_VALID_JSON"
        ],
        "total_components": 0,
        "total_algorithm_assets": 0,
        "vulnerable_count": 0,
        "cnsa2_ready_count": 0,
        "unclassified_count": 0,
        "structurally_invalid_count": 0,
        "findings": [],
        "compliance_flags": [
          "CBOM_STRUCTURAL_ISSUES_FOUND",
          "STRUCTURAL_LINT_ONLY_NOT_A_SCANNER"
        ]
      },
      "golden_hash": "7d6bf84224768b6148dee295933f750ca7c0d8a254a7467a6bdb12c4c3e9d8ea"
    }
  ]
}