From 8b6e3b4919d869c2b4b87c994cdad28daffbe22b Mon Sep 17 00:00:00 2001
From: reynold <reynold.e.lariza@pwc.com>
Date: Sat, 18 Jul 2026 20:21:38 +0800
Subject: [PATCH] feat: seed Lariza feature demonstration

Add synthetic fixtures and proposed policy contracts for safely demonstrating future Lariza capabilities.

Assisted-by: Codex: GPT-5.6
---
 .lariza/security-policy.yaml  | 17 +++++++++++++++++
 README.md                     | 12 ++++++++++++
 fixtures/junit.xml            |  7 +++++++
 fixtures/sample.sarif.json    | 24 ++++++++++++++++++++++++
 fixtures/sbom.cdx.json        | 15 +++++++++++++++
 fixtures/secret-findings.json | 15 +++++++++++++++
 src/transfer.go               |  6 ++++++
 7 files changed, 96 insertions(+)
 create mode 100644 .lariza/security-policy.yaml
 create mode 100644 README.md
 create mode 100644 fixtures/junit.xml
 create mode 100644 fixtures/sample.sarif.json
 create mode 100644 fixtures/sbom.cdx.json
 create mode 100644 fixtures/secret-findings.json
 create mode 100644 src/transfer.go

diff --git a/.lariza/security-policy.yaml b/.lariza/security-policy.yaml
new file mode 100644
index 0000000..2c9cea9
--- /dev/null
+++ b/.lariza/security-policy.yaml
@@ -0,0 +1,17 @@
+apiVersion: security.lariza.dev/v1alpha1
+kind: SecurityPolicyIntent
+metadata:
+  name: default-security-gate
+spec:
+  mode: audit
+  trustedPublishers: [lariza-security-demo]
+  mergeGate:
+    blockNewSeverities: [critical, high]
+    requireTriageFor: [medium]
+    dismissedFindingsRequire:
+      reason: true
+      expiresAt: true
+      approverRole: security-owner
+  evidence:
+    acceptedFormats: [sarif-2.1.0, cyclonedx-1.5, junit]
+    retainDays: 90
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..19e39f5
--- /dev/null
+++ b/README.md
@@ -0,0 +1,12 @@
+# Security evidence demo
+
+This repository contains small, synthetic evidence files for developing Lariza
+ingestion, triage, pull-request summaries, and merge policies.
+
+- `sample.sarif.json`: one safe static-analysis finding.
+- `sbom.cdx.json`: a minimal CycloneDX inventory.
+- `junit.xml`: one passing and one skipped test.
+- `secret-findings.json`: redacted evidence with no usable credential.
+
+No scanner runs here. The goal is to normalize external evidence, establish
+trusted publisher identity, explain policy outcomes, and test retention/export.
diff --git a/fixtures/junit.xml b/fixtures/junit.xml
new file mode 100644
index 0000000..078a98e
--- /dev/null
+++ b/fixtures/junit.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<testsuite name="lariza-demo" tests="2" failures="0" skipped="1" time="0.02">
+  <testcase classname="demo.Transfer" name="accepts reference" time="0.02"/>
+  <testcase classname="demo.Transfer" name="external settlement">
+    <skipped message="Synthetic external dependency is unavailable in the demo."/>
+  </testcase>
+</testsuite>
diff --git a/fixtures/sample.sarif.json b/fixtures/sample.sarif.json
new file mode 100644
index 0000000..4d3f0c7
--- /dev/null
+++ b/fixtures/sample.sarif.json
@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Lariza Synthetic Analyzer",
+          "version": "1.0.0",
+          "rules": [{"id": "DEMO001", "shortDescription": {"text": "Synthetic review finding"}}]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "DEMO001",
+          "level": "warning",
+          "message": {"text": "Synthetic medium-severity result for triage demonstrations."},
+          "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/transfer.go"}, "region": {"startLine": 4}}}],
+          "properties": {"severity": "medium", "synthetic": true}
+        }
+      ]
+    }
+  ]
+}
diff --git a/fixtures/sbom.cdx.json b/fixtures/sbom.cdx.json
new file mode 100644
index 0000000..3a864c3
--- /dev/null
+++ b/fixtures/sbom.cdx.json
@@ -0,0 +1,15 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "serialNumber": "urn:uuid:11111111-2222-4333-8444-555555555555",
+  "version": 1,
+  "metadata": {"component": {"type": "application", "name": "security-evidence-demo", "version": "1.0.0"}},
+  "components": [
+    {
+      "type": "library",
+      "name": "synthetic-safe-library",
+      "version": "1.2.3",
+      "purl": "pkg:generic/synthetic-safe-library@1.2.3"
+    }
+  ]
+}
diff --git a/fixtures/secret-findings.json b/fixtures/secret-findings.json
new file mode 100644
index 0000000..b066b80
--- /dev/null
+++ b/fixtures/secret-findings.json
@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "1.0",
+  "findings": [
+    {
+      "id": "synthetic-secret-001",
+      "type": "example-api-token",
+      "severity": "high",
+      "path": "fixtures/nonexistent.env",
+      "line": 1,
+      "evidence": "demo_****_REDACTED",
+      "usableCredential": false,
+      "synthetic": true
+    }
+  ]
+}
diff --git a/src/transfer.go b/src/transfer.go
new file mode 100644
index 0000000..fa9e880
--- /dev/null
+++ b/src/transfer.go
@@ -0,0 +1,6 @@
+package demo
+
+// Transfer is intentionally simple source code referenced by the SARIF fixture.
+func Transfer(reference string) string {
+	return "accepted:" + reference
+}