Security evidence demo

This repository contains small, synthetic evidence files for developing Lariza ingestion, triage, pull-request summaries, and merge policies.

• sample.sarif.json: one safe static-analysis finding.
• sbom.cdx.json: a minimal CycloneDX inventory.
• junit.xml: one passing and one skipped test.
• secret-findings.json: redacted evidence with no usable credential.

No scanner runs here. The goal is to normalize external evidence, establish trusted publisher identity, explain policy outcomes, and test retention/export.