{
  "artifact_type": "pipeline_bom",
  "sample_status": "synthetic_illustrative",
  "evidence_snapshot": {
    "artifact_name": "payment-service",
    "artifact_version": "2.4.1",
    "build_id": "build-8842",
    "commit_sha": "a1b2c3d4e5f6",
    "repository": "https://github.com/example/payment-service",
    "dependencies": [
      {
        "name": "libcrypto",
        "version": "3.1.2",
        "source": "internal_registry",
        "hash": "sha256:..."
      },
      {
        "name": "web-framework",
        "version": "5.0.1",
        "source": "public_registry",
        "hash": "sha256:..."
      }
    ],
    "scanner_results": [
      {
        "tool": "primary_sast",
        "high_findings": 0,
        "critical_findings": 0,
        "completed_at": "2026-07-20T09:12:00Z"
      },
      {
        "tool": "container_scan",
        "critical_findings": 0,
        "completed_at": "2026-07-20T08:45:00Z"
      }
    ],
    "build_provenance": {
      "builder": "ci-builder-07",
      "build_started_at": "2026-07-20T08:30:00Z",
      "build_completed_at": "2026-07-20T08:55:00Z",
      "invocation_uri": "https://ci.example.org/runs/8842"
    }
  },
  "policy_version": "v1.3.2",
  "policy_digest": "sha256:a1b2c3...f4e5d6",
  "freshness_state": "fresh",
  "trust_state": "qualified",
  "runtime_corroboration": {
    "source": "runtime_telemetry",
    "status": "not_deployed"
  },
  "dsse_envelope": {
    "payload_type": "application/vnd.gosentrix.bom+json",
    "signatures": [
      {
        "keyid": "bom-signer-2026",
        "sig": "..."
      }
    ]
  },
  "decision_fingerprint": "sha256:9f8e7d...6c5b4a",
  "downgrade_reason_codes": [],
  "replay_command": "gosentrix replay --bom gosentrix:bom:payment-service:2.4.1@build-8842 --policy-version v1.3.2"
}