
ASR — 0123 Transcript (JSON)
Ground-truth transcript for the 0123 ASR utterance pair — expected text: “zero one two three”.
- File
- JSON · Asr
- Use case
- ASR testingJSON parsing· Conversion set
Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.

Ground-truth transcript for the 0123 ASR utterance pair — expected text: “zero one two three”.

Ground-truth transcript for the 4567 ASR utterance pair — expected text: “four five six seven”.

Ground-truth transcript for the 89 ASR utterance pair — expected text: “eight nine”.

Ground-truth transcript for the 1357 ASR utterance pair — expected text: “one three five seven”.

Ground-truth transcript for the 24680 ASR utterance pair — expected text: “two four six eight zero”.

Ground-truth transcript for the 987654 ASR utterance pair — expected text: “nine eight seven six five four”.

Ground-truth transcript for extra ASR utterance 1111.

Ground-truth transcript for extra ASR utterance 2222.

Ground-truth transcript for extra ASR utterance 3333.

Ground-truth transcript for extra ASR utterance 4444.

Ground-truth transcript for extra ASR utterance 5555.

Ground-truth transcript for extra ASR utterance 6666.

Ground-truth transcript for extra ASR utterance 7777.

Ground-truth transcript for extra ASR utterance 8888.

Ground-truth transcript for extra ASR utterance 9999.

Ground-truth transcript for extra ASR utterance 0000.

A flat JSON array of ten simple objects — the baseline case for JSON parsing and mapping.

A deeply nested JSON document with objects inside arrays inside objects — for testing recursive parsing and path access.

A JSON Lines file with one object per line — for testing streaming/newline-delimited JSON parsers.

An intentionally invalid JSON file with a trailing comma and a missing closing brace — for testing parser error handling and messages. Not valid JSON by design.

A GeoJSON FeatureCollection with a point, a line, and a polygon — for testing map tools and geo importers.

A newline-delimited JSON (NDJSON) stream of event records — for testing streaming JSON parsers.

A draft-07 JSON Schema describing a user object — for testing schema validators and schema-aware tooling.

A valid Jupyter notebook (nbformat 4.5) with markdown cells, code cells, and real outputs (stdout stream and an execute result) — for testing notebook parsers, nbconvert, and JSON tooling.

The decoded header and payload of the sample JWT as JSON, alongside the public signing secret and algorithm — the ground truth for checking a JWT decoder's output.

A Docker json-file container log — one JSON object per line with the log text, stream (stdout/stderr), and an RFC 3339 timestamp, exactly as Docker's default logging driver writes it. A fixture for container-log shippers and parsers.

A JSON object that repeats several member names (name, tags, timeout, active). RFC 8259 permits duplicate keys but leaves the result parser-defined — most keep the last. A fixture for testing how a JSON parser resolves duplicates.

A JSON Feed 1.1 document — the JSON alternative to RSS/Atom — with a feed header and three items using content_html, content_text, tags, and publish dates, for testing JSON Feed parsers and readers.

Synthetic product-analytics events (signup/login/upgrade) for testing event pipelines and warehouse loads. JSON twin.

A point-of-sale SKU catalog with tax codes and active flags — fictional Meridian Supply inventory. JSON twin.

Synthetic lab readings (temperature, pressure, pH) with ISO timestamps for scientific ETL tests. JSON twin.

Synthetic multi-touch attribution click rows with UTM fields — for marketing analytics importers. JSON twin.

JSON twin of the finance/ledger-lines mini-dataset.

JSON twin of the support/tickets mini-dataset.

Deterministic synthetic JSON batch 01 for bulk-import smoke tests.

Deterministic synthetic JSON batch 02 for bulk-import smoke tests.

Deterministic synthetic JSON batch 03 for bulk-import smoke tests.

Deterministic synthetic JSON batch 04 for bulk-import smoke tests.

Deterministic synthetic JSON batch 05 for bulk-import smoke tests.

Deterministic synthetic JSON batch 06 for bulk-import smoke tests.

Deterministic synthetic JSON batch 07 for bulk-import smoke tests.

Deterministic synthetic JSON batch 08 for bulk-import smoke tests.

Deterministic synthetic JSON batch 09 for bulk-import smoke tests.

Deterministic synthetic JSON batch 10 for bulk-import smoke tests.

Deterministic synthetic JSON batch 11 for bulk-import smoke tests.

Deterministic synthetic JSON batch 12 for bulk-import smoke tests.

Deterministic synthetic JSON batch 13 for bulk-import smoke tests.

Deterministic synthetic JSON batch 14 for bulk-import smoke tests.

Deterministic synthetic JSON batch 15 for bulk-import smoke tests.

Deterministic synthetic JSON batch 16 for bulk-import smoke tests.

Deterministic synthetic JSON batch 17 for bulk-import smoke tests.

Deterministic synthetic JSON batch 18 for bulk-import smoke tests.

Deterministic synthetic JSON batch 19 for bulk-import smoke tests.

Deterministic synthetic JSON batch 20 for bulk-import smoke tests.

JSON twin of the hr/employees-mini mini-dataset.

JSON twin of the iot/sensor-readings-mini mini-dataset.

A valid OpenAPI 3.1 pet-store SAMPLE spec in JSON — list/create pets with paginated responses for schema-validator and codegen tests.

YAML twin of the valid pet-store OpenAPI spec — for testing YAML spec parsers and JSON↔YAML conversion.

Draft 2020-12 JSON Schema for a user object with email format and role enum — paired with valid/invalid instances.

Sparse event log in JSON Lines — two events hours apart for event-stream ingestion tests.

Cursor-paginated SAMPLE API response page 1 with nextCursor metadata.

Cursor-paginated SAMPLE API response page 2 with nextCursor metadata.

Offset/limit paginated SAMPLE response page 1 for list-merge tests.

Offset/limit paginated SAMPLE response page 2 for list-merge tests.

Sample GraphQL query response with nested user and orders — for GraphQL client tests.

Sample GraphQL mutation success payload for testing mutation handlers.

GraphQL error response with message and location — negative case for GraphQL clients.

SAMPLE stripe payment webhook JSON body for signature-verification and parser tests.

SAMPLE github push webhook JSON body for signature-verification and parser tests.

SAMPLE slack message webhook JSON body for signature-verification and parser tests.

GraphQL subscription event payload for realtime client tests.

Rate-limit header values captured as JSON for middleware testing.

Documented HMAC webhook signature SAMPLE — no real secret, for verifier unit tests.

Batch API response mixing success and failure per sub-request.

Partial GraphQL introspection result for schema-stitching tests.

Callback payload matching the Wave F webhook OpenAPI SAMPLE.

RFC 5988 Link header pagination metadata as JSON for HTTP client tests.

Nested pagination object for comments under a post — tests deeply nested page tokens.

Empty paginated response — edge case for UI empty states and merge logic.

Paginated response where total count disagrees with items length — tests inconsistency detection.

Synthetic FHIR Claim resource for healthcare billing parser tests — not a real patient.

SAMPLE procedure code list with fees for medical billing calculator tests.

Fictional insurance eligibility check response for prior-auth workflow tests.

Balanced double-entry ledger SAMPLE for accounting engine validation tests.

Daily USD/EUR SAMPLE rates for FX chart and conversion tests.

Multi-level bill-of-materials SAMPLE for MRP and assembly planning tests.

Warehouse and bin metadata for WMS routing tests.

JSON application settings for config-merge and validation tests.

JSON description of nullable columns in the null-heavy columnar fixtures.

RFC 7807 SAMPLE problem document for HTTP 404 (Not Found) client tests.

RFC 7807 SAMPLE problem document for HTTP 401 (Unauthorized) client tests.

RFC 7807 SAMPLE problem document for HTTP 403 (Forbidden) client tests.

RFC 7807 SAMPLE problem document for HTTP 409 (Conflict) client tests.

RFC 7807 SAMPLE problem document for HTTP 410 (Gone) client tests.

RFC 7807 SAMPLE problem document for HTTP 429 (Too Many Requests) client tests.

RFC 7807 SAMPLE problem document for HTTP 422 (Unprocessable Entity) client tests.

RFC 7807 SAMPLE problem document for HTTP 400 (Bad Request) client tests.

RFC 7807 SAMPLE problem document for HTTP 415 (Unsupported Media Type) client tests.

RFC 7807 SAMPLE problem document for HTTP 406 (Not Acceptable) client tests.

RFC 7807 SAMPLE problem document for HTTP 503 (Service Unavailable) client tests.

RFC 7807 SAMPLE problem document for HTTP 500 (Internal Server Error) client tests.

Minimal JSON Schema SAMPLE focusing on additional properties false constraints.

Minimal JSON Schema SAMPLE focusing on one of status constraints.

Minimal JSON Schema SAMPLE focusing on enum currency constraints.

Minimal JSON Schema SAMPLE focusing on pattern sku constraints.

Minimal JSON Schema SAMPLE focusing on nullable optional constraints.

Minimal JSON Schema SAMPLE focusing on array unique items constraints.

Minimal JSON Schema SAMPLE focusing on dependent required constraints.

Minimal JSON Schema SAMPLE focusing on format uri email constraints.

SAMPLE submitted-field snapshot JSON for the employment i-9 style form.

SAMPLE submitted-field snapshot JSON for the residential lease form.

SAMPLE submitted-field snapshot JSON for the donation pledge form.

SAMPLE submitted-field snapshot JSON for the event rsvp form.

SAMPLE submitted-field snapshot JSON for the wire / ach transfer form.

SAMPLE submitted-field snapshot JSON for the student enrollment form.

SAMPLE submitted-field snapshot JSON for the parking permit form.

A machine-readable reference for every HTML5 constraint attribute: which control types accept it, an example that validates, an example that does not, and the behaviour that surprises people. Paired with the constraint-matrix forms in this wave.

The autofill token vocabulary grouped by purpose, with the section, address-type and contact-type prefixes and the rules for ordering them. A companion to the five autocomplete forms in this wave.

Sample wording for each constraint-validation failure, in a terse and a helpful variant, so message copy can be reviewed without wiring a real form first. Fictional product, fictional copy.

The control data for the three-page sample sign-up wizard: which fields each page owns, which are mandatory, what is carried forward and which file comes next. Lets a driver plan the whole flow before opening a page.

Size and count limits for every file control in this wave, together with the rejection codes an application would return. HTML expresses none of these, so the manifest is where they have to live.

One submission in both shapes: the flat name and value pairs a browser sends, and the nested object a framework builds from them. The expected output for the bracket-notation form shipped alongside it.

An index of the six AcroForm families in this wave: the canonical field names, the control kind behind each one, the flags in use, and the four artifacts every family ships.

The AcroForm field-flag bits a PDF filler has to honour, with the control kinds each applies to and what it changes. Includes the subset actually exercised by the PDFs in this wave.

Eighteen numbered assertions, each naming one fixture in this wave and the single behaviour it proves. Enough to drive a form extractor's test suite without inventing expectations first.

Intentionally corrupt. A field manifest that claims to describe acro-checkbox-matrix.pdf but names two fields the PDF does not have, omits one it does, contradicts one field's type and states a count that does not match its own array.

Intentionally corrupt. A form schema breaking seven rules at once: an unknown version, a field with no name, an unknown type, an empty option list, a default outside its options, bounds the wrong way round and a duplicated id.

JSON semantic reference for the FBX tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-fbx-reference.

JSON semantic reference for the 3DS tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-3ds-reference.

JSON semantic reference for the AMF tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-amf-reference.

JSON semantic reference for the LWO tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-lwo-reference.

JSON semantic reference for the VTK tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-vtk-reference.

JSON semantic reference for the VOX fixture, publishing occupied coordinates, palette indices, empty face topology, bounds, and the voxel contract. Stable P8 artifact p8-convert-model-vox-reference.

JSON semantic reference for the DRC tetrahedron, publishing vertex order, face indices, bounds, and the closed-mesh contract. Stable P8 artifact p8-convert-model-drc-reference.

A labelled sentiment-classification dataset in JSON Lines — 24 short product-review-style sentences balanced across positive, negative, and neutral. Fully synthetic; a fixture for testing text-classification loaders, tokenizers, and JSONL parsers.

A token-classification dataset in JSON Lines — 16 tokenized sentences with aligned BIO tags for person, organisation, and location entities. All names, companies, and places are fictional. A fixture for NER model training and sequence-labelling tooling.

A chat fine-tuning dataset in the OpenAI JSONL format — one conversation per line as a messages array with system, user, and assistant turns. Synthetic Q&A content. Paired with an Anthropic-format twin for testing format converters.

The same synthetic conversations in the Anthropic Messages JSONL shape — a top-level system prompt plus a messages array of user and assistant turns. The format twin of the OpenAI file, for testing chat-format conversion.

An instruction-tuning dataset in the Alpaca JSONL format — 20 instruction / input / output triples covering small transformations, extraction, and factual answers. Fully synthetic; a fixture for supervised fine-tuning pipelines.

An extractive question-answering dataset in the SQuAD v2.0 JSON structure — titled articles with context paragraphs, questions, character-offset answers, and one deliberately unanswerable question. Synthetic content; a fixture for QA model training and SQuAD-format loaders.

An abstractive-summarization dataset in JSON Lines — 15 short synthetic news-style documents each paired with a one-sentence summary. A fixture for training and evaluating summarization models and for testing JSONL ingestion.

An English↔Spanish parallel corpus in JSON Lines — 20 aligned sentence pairs of everyday phrases. A fixture for training and evaluating machine-translation models and for testing UTF-8 handling of accented characters.

A set of 24 L2-normalised 16-dimensional text embeddings as JSON — each record pairs an id and its source text with a float vector. A fixture for testing vector stores, similarity search, and embedding loaders. Parquet and .npy twins included.

Object-detection annotations for the scene in the COCO JSON format — images, categories, and per-object bounding boxes as [x, y, width, height]. Grouped with YOLO and Pascal-VOC twins for testing annotation-format conversion.

A model-evaluation summary in JSON — per-task scores for a fictional model across sentiment, NER, summarization, translation, and QA, each with its metric and sample size. A fixture for testing eval dashboards and leaderboard importers.

The same 3-class confusion matrix as JSON — a labels array plus a nested counts matrix. The structured twin of the CSV, for testing evaluation tooling.

A per-class classification report in the scikit-learn structure — precision, recall, F1, and support for each class plus accuracy and macro/weighted averages. A fixture for testing metric parsers and report renderers.

A reusable prompt library in JSON Lines — 20 templated prompts for summarization, translation, extraction, code, and more, each with a task label, tags, and {curly-brace} placeholders. A fixture for prompt-management tools and JSONL parsers.

Retrieval-eval queries with relevant_docs pointers into the mini RAG Markdown corpus.

Class-id to name map for the semantic-segmentation mask (background + three shapes).

Named-entity spans over fictional SAMPLE PII sentences — for redaction/NER tooling tests.

COCO JSON with bounding boxes and polygon segmentation for the warehouse scene.

COCO JSON with bounding boxes and polygon segmentation for the retail scene.

COCO JSON with bounding boxes and polygon segmentation for the aerial scene.

Synthetic mAP evaluation summary for object-detection benchmark harness tests.

Multi-label classification JSONL with two labels per row.

Hierarchical category labels for taxonomy-aware classifiers.

Imbalanced label distribution — 2 rare vs 8 common rows.

Zero-shot candidate label lists per text for NLI-style classifiers.

Intent classification JSONL for dialog systems.

Topic classification rows for news routing tests.

Language identification JSONL with EN/ES pairs.

Binary toxicity labels for moderation model eval.

BM25 score snapshot for comparing neural rerankers against a lexical baseline.

OpenAI-style tool-call JSONL with function invocation and tool result messages.

Function-call result rows decoupled from chat messages for router testing.

L2-normalised 8-dimensional text embeddings in JSON — for vector store loader tests.

ID list and model metadata for the Wave F embedding set.

JSON twin of the 3-class confusion matrix.

Manifest linking Wave F scene PNGs to per-language caption JSONL files.

Short query list for ranking benchmark harness smoke tests.

Label id/name map companion for Wave F classification JSONL fixtures.

Minimal SAMPLE eval metric JSON (accuracy) for dashboard parsers.

Minimal SAMPLE eval metric JSON (f1) for dashboard parsers.

Minimal SAMPLE eval metric JSON (latency_ms) for dashboard parsers.

Minimal SAMPLE eval metric JSON (toxicity) for dashboard parsers.

Minimal SAMPLE eval metric JSON (bleu) for dashboard parsers.

SAMPLE tool-calling JSON (tool-call-weather) for agent harness schema tests.

SAMPLE tool-calling JSON (tool-result-weather) for agent harness schema tests.

SAMPLE tool-calling JSON (tool-call-search) for agent harness schema tests.

SAMPLE tool-calling JSON (tool-parallel-two) for agent harness schema tests.

SAMPLE tool-calling JSON (tool-error-unknown) for agent harness schema tests.

The named float32 input tensor payload for the Static Identity model, with explicit shapes and JSON values for runner-independent test setup.

The reference-evaluator output for the Static Identity model and supplied input, including shape, dtype, exact values and a 1e-6 tolerance.

The named float32 input tensor payload for the Affine MatMul plus Add model, with explicit shapes and JSON values for runner-independent test setup.

The reference-evaluator output for the Affine MatMul plus Add model and supplied input, including shape, dtype, exact values and a 1e-6 tolerance.

The named float32 input tensor payload for the Two-Input Broadcast Add model, with explicit shapes and JSON values for runner-independent test setup.

The reference-evaluator output for the Two-Input Broadcast Add model and supplied input, including shape, dtype, exact values and a 1e-6 tolerance.

The named float32 input tensor payload for the Dynamic-Batch ReduceSum model, with explicit shapes and JSON values for runner-independent test setup.

The reference-evaluator output for the Dynamic-Batch ReduceSum model and supplied input, including shape, dtype, exact values and a 1e-6 tolerance.

A complete Progressive Web App manifest with a full icon spread, shortcuts, categories, and theme colours — for testing PWA installers, manifest validators, and JSON parsers.

An Apple app-site-association file declaring Universal Links, web credentials, and app clips — normally served without an extension at /.well-known/, for testing AASA parsers (shown here as .json).

An Android Digital Asset Links file granting app-link handling to a package via a certificate fingerprint (sample) — for testing assetlinks.json parsers and App Links verification.

.well-known SAMPLE JSON (related-website-set) for crawler and client discovery tests.

.well-known SAMPLE JSON (web-identity) for crawler and client discovery tests.

.well-known SAMPLE JSON (passkey-endpoints) for crawler and client discovery tests.

.well-known SAMPLE JSON (privacy-sandbox-attest) for crawler and client discovery tests.

.well-known SAMPLE JSON (nodeinfo-stub) for crawler and client discovery tests.

.well-known SAMPLE JSON (webfinger-resource) for crawler and client discovery tests.

.well-known SAMPLE JSON (openid-configuration-min) for crawler and client discovery tests.

.well-known SAMPLE JSON (assetlinks-extra) for crawler and client discovery tests.

schema.org JSON-LD SAMPLE (faq-page) for SEO/structured-data validators.

schema.org JSON-LD SAMPLE (howto-step) for SEO/structured-data validators.

schema.org JSON-LD SAMPLE (organization) for SEO/structured-data validators.

schema.org JSON-LD SAMPLE (breadcrumb) for SEO/structured-data validators.

schema.org JSON-LD SAMPLE (software-app) for SEO/structured-data validators.

schema.org JSON-LD SAMPLE (web-page) for SEO/structured-data validators.

.well-known SAMPLE JSON (change-password-rel) for crawler and client discovery tests.

.well-known SAMPLE JSON (gpc-policy) for crawler and client discovery tests.

A complete v3 source map for the minified bundle: two sources with their full original text inlined in sourcesContent, two names, and five VLQ-encoded mapping segments. For testing source-map decoders and stack-trace symbolication without any network fetch of the originals.

The same v3 map with the sourcesContent array removed, which is how most production builds ship: the mappings resolve but the original text has to be fetched from the paths in `sources`. For testing the fallback path of a debugger when originals are unavailable.

An index map: instead of a top-level `mappings` string it carries a `sections` array of offset-and-map pairs, the form used when several independently built chunks are concatenated. For testing decoders that assume every map has mappings at the root.

The v3 map for the minified stylesheet: one source with its text inlined, an empty names array, and three segments covering the selector and both declarations. For testing that a decoder handles maps with no names at all.

A v3 map that resolves its sources through a `sourceRoot` scheme URL, uses `../` relative paths, leaves one sourcesContent entry null, and marks the second source as third-party via x_google_ignoreList. For testing URL joining and ignore-list support in a debugger.

A deliberately invalid source map: version 2 instead of 3, a sources array longer than sourcesContent, a mapping segment that names an index outside `names`, and a `$` that is not in the base64 VLQ alphabet. For testing that a decoder validates the envelope before trusting the mappings.

A web app manifest whose icon array is built entirely from the awkward cases: a duplicate declaration, an entry with no sizes, sizes="any" on an SVG, a multi-size ICO, a .webp declared as image/png, a cross-origin icon and a 0x0 entry. For testing icon selection and validation logic.

A manifest exercising every icon `purpose` keyword: any, maskable, the space-separated combination, monochrome for a notification badge, and the obsolete `badge` value. For testing purpose parsing and adaptive-icon safe-zone handling.

The smallest manifest that still satisfies a browser's install criteria: name, start_url, a standalone display mode and two PNG icons, with every optional member left out. For testing installability checks against the floor rather than a fully populated document.

A deliberately invalid manifest: well-formed JSON with an empty icons array, so it parses cleanly and then fails installability. For testing that a PWA validator distinguishes a parse error from an unmet install requirement.

A manifest declaring a Web Share Target that accepts a POST of multipart form data, including two file parameters with MIME-type and extension accept lists. For testing share-target registration and the parameter renaming a share handler must perform.

A manifest registering the desktop-integration members: two file handlers with MIME and extension accept maps, a custom web+ protocol handler alongside mailto, a launch_handler client mode list, an Edge side-panel width and handle_links. For testing OS integration and manifest members a validator may not know.

A manifest with the members that turn a bare install prompt into a rich one: four screenshots split across wide, narrow and unspecified form factors, labels, categories and two shortcuts (one with its own icon). For testing rich-install eligibility rules.

A deliberately invalid manifest: start_url sits at /dashboard/ while scope is /app/, and a shortcut points at another origin entirely. Both are the kind of mistake that makes an installed app open in a browser tab. For testing scope-containment validation.

The JSON Resource Descriptor twin of the XRD host-meta: identical subject, alias, expiry, property and three links, expressed with lower-case JSON member names. For testing XRD-to-JRD conversion against a known answer.

A traffic-advice document opting a fictional origin into private prefetch proxy traffic at full fraction while disallowing every other agent. For testing prefetch-proxy discovery and the JSON-array (not object) top level this format uses.

The one-member server-delegation document that lets example.com host its Matrix homeserver at matrix.example.com:8448 without changing user IDs. For testing federation discovery and explicit-port handling.

The client-side twin of the Matrix delegation pair: homeserver and identity server base URLs plus an unregistered vendor key, which clients must carry through rather than reject. For testing discovery and unknown-member tolerance.

A fully populated RFC 8414 authorization-server metadata document for a fictional issuer: seven endpoints including PAR, introspection and dynamic registration, PKCE and DPoP algorithm lists, and policy URIs. Distinct from the minimal OpenID configuration already in this category.

A valid Product record with a nested Offer carrying price, currency, availability, condition and shipping details, plus an AggregateRating. For testing rich-result validators and structured-data extractors against a document that should pass cleanly.

A valid NewsArticle with two authors, a publisher whose logo carries explicit pixel dimensions, three images at the aspect ratios news results expect, and both publication and modification timestamps. For testing article extraction and date normalisation.

A valid Event record for a hybrid event: both a physical Place with a postal address and geo coordinates and a VirtualLocation, plus a free Offer and a capacity. For testing array-valued properties and event date/timezone handling.

A valid Recipe with ISO 8601 durations, four ingredients, and instructions that mix flat HowToStep nodes with a nested HowToSection. For testing duration parsing and recursive instruction extraction.

A valid LocalBusiness (as a SportingGoodsStore subtype) with a postal address, geo coordinates, weekday and Saturday opening hours, and a 00:00-00:00 specification marking a holiday closure. For testing opening-hours parsing and the closed-all-day convention.

A single @graph holding four nodes wired together by @id rather than by nesting - the shape most CMS plugins emit - including a SearchAction, a breadcrumb whose last item has no URL, and one reference to a product node that lives on another page. For testing graph flattening and reference resolution.

A deliberately invalid Product record: no name, an Offer with a currency but no price, a brand with no @type, a Review with no rating, an AggregateRating with no ratingValue, and an availability given as a bare token instead of a schema.org URL. Valid JSON throughout, so the failure is semantic.

A deliberately invalid Recipe carrying six unambiguously wrong-typed values - a numeric datePublished, a prose prepTime where an ISO 8601 duration belongs, an object recipeYield, two non-numeric ratings and a misspelled @type - plus a relative @context that never resolves, an untyped image object and two ingredients crammed into one string. For testing the limits of type coercion.

The third twin: the same four articles as JSON Feed 1.1, using the 1.1 `authors` array rather than the 1.0 singular form, with ids, URLs, summaries, HTML bodies and timestamps identical to the RSS and Atom files. The reference output for an XML-to-JSON feed converter.

Flat JSON locale pack for French with Mustache-style {{name}} placeholders.

Flat JSON locale pack for German with Mustache-style {{name}} placeholders.

Flat JSON locale pack for Portuguese (Brazil) with Mustache-style {{name}} placeholders.

Flat JSON locale pack for Korean with Mustache-style {{name}} placeholders.

English ICU MessageFormat catalog whose messages nest a select inside a plural branch and a plural inside a select branch, shipped with the argument bindings and the exact output each one must produce. Includes the '#' binding trap: inside a nested plural, '#' refers to the inner argument, so the outer count is written explicitly.

Arabic ICU MessageFormat catalog whose messages nest a select inside a plural branch and a plural inside a select branch, shipped with the argument bindings and the exact output each one must produce. Includes the '#' binding trap: inside a nested plural, '#' refers to the inner argument, so the outer count is written explicitly.

Polish ICU MessageFormat catalog whose messages nest a select inside a plural branch and a plural inside a select branch, shipped with the argument bindings and the exact output each one must produce. Includes the '#' binding trap: inside a nested plural, '#' refers to the inner argument, so the outer count is written explicitly.

The 'Rana and 5 others like this' pattern: ICU plural arguments with offset:1 and offset:2, where the explicit =0/=1/=2 selectors match the RAW value but '#' prints the value MINUS the offset. Ships every boundary case with its expected output.

English st/nd/rd/th suffixes done properly, via ICU selectordinal rather than a hand-written switch. The case list covers the teens (11th, 12th, 13th) and the wrap-around (21st, 102nd, 111th) that a naive n % 10 lookup gets wrong.

Welsh is the only CLDR locale that uses all six plural categories for cardinals AND all six for ordinals, which makes it the strongest single probe for a plural-rule engine. Each branch names its own category so the assertion is about selection, not wording, and the two rule sets disagree for n = 4, 5, 7, 8 and 9.

Arabic CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: a catalog written with only one/other silently renders 'many' counts (11-99) with the singular noun form.

Welsh CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: welsh is the only cldr locale using all six categories for both cardinals and ordinals, and its categories are enumerations (3, 6) rather than modulo ranges — a rule engine that assumes 'few' means a range fails here.

Polish CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: cldr gives polish four categories but the traditional gettext header gives it three — gettext folds cldr 'many' and 'other' together because its rule takes an integer n and never sees v.

Russian CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: 1 and 21 take the same form but 11 does not; a naive n==1 check gets 21 wrong.

English CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: '1.

Japanese CLDR cardinal and ordinal plural rules with the exact integer samples that select each category, the equivalent gettext Plural-Forms expression, and a note on the trap the language exposes: japanese needs exactly one form; a pipeline that requires a 'one' key produces a catalog no japanese translator can fill in meaningfully.

A English ARB whose plural messages carry an ICU branch for each of the 2 categories en selects, plus a select message and a summary line with typed placeholders — int with compactLong, and a DateTime with a yMMMd format — which is what makes gen_l10n emit a typed Dart method rather than a plain string.

A Arabic ARB whose plural messages carry an ICU branch for each of the 6 categories ar selects, plus a select message and a summary line with typed placeholders — int with compactLong, and a DateTime with a yMMMd format — which is what makes gen_l10n emit a typed Dart method rather than a plain string.

A Polish ARB whose plural messages carry an ICU branch for each of the 4 categories pl selects, plus a select message and a summary line with typed placeholders — int with compactLong, and a DateTime with a yMMMd format — which is what makes gen_l10n emit a typed Dart method rather than a plain string.

A Welsh ARB whose plural messages carry an ICU branch for each of the 6 categories cy selects, plus a select message and a summary line with typed placeholders — int with compactLong, and a DateTime with a yMMMd format — which is what makes gen_l10n emit a typed Dart method rather than a plain string.

Three notification templates in English, Arabic and Hebrew, each given raw and with every interpolation slot wrapped in FSI…PDI, plus four argument sets covering an LTR name in an RTL sentence, an RTL name in an LTR sentence and a name beginning with a neutral character. This is the fixture for the bug where a display name reorders the sentence around it.

The structured twin of the number-format table, plus four documented traps: es-ES's minimumGroupingDigits=2 (which leaves a four-digit integer ungrouped), the four non-ASCII group separators, the arab numbering system's own digits, and the seven locales here whose decimal separator is a comma.

The structured currency table with the three traps spelled out: minor units belong to the CURRENCY not the locale (JPY 0, USD 2, KWD/BHD/JOD 3), the gap before a trailing symbol is U+00A0 in six of these locales, and CLDR's ar-EG pattern contains an invisible U+200F that breaks naive equality assertions.

The structured date table plus the four traps worth their own test: day/month ambiguity in short dates, the RLM embedded in CLDR's Arabic pattern, quoted literal text inside the Russian pattern, and the localized day-period marker that a 12-hour formatter must not drop.

Era and era-year for one instant across five calendar systems. The three whose months and days align with the Gregorian calendar — Japanese (Reiwa 8), ROC (Minguo 115) and Thai Buddhist (2569) — carry a full rendered date; the Hijri and Hebrew entries carry the year only, because their day and month depend on the calculation variant and, for Hijri, on observation. Saying so is the point of the fixture.

OAuth 2.0 SAMPLE error JSON (invalid_grant) for client error-path tests.

OAuth 2.0 SAMPLE error JSON (invalid_client) for client error-path tests.

OAuth 2.0 SAMPLE error JSON (invalid_scope) for client error-path tests.

OAuth 2.0 SAMPLE error JSON (temporarily_unavailable) for client error-path tests.

OAuth 2.0 SAMPLE error JSON (insufficient_scope) for client error-path tests.

OAuth 2.0 SAMPLE error JSON (unauthorized_client) for client error-path tests.

JWT Header Claims — RS256 SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).

JWT Payload — Expired SAMPLE — unsigned JSON companion for claim-parser tests (not a live token).

Forty builds of six tests, one JSON object per line, with three tests that fail intermittently and three that never do. This is the input shape a flake detector ingests; the CSV twin in this group holds the aggregate it should produce.

The raw Istanbul document nyc and Jest write before any reporter runs: statementMap, fnMap and branchMap giving source locations, with the s, f and b objects holding the hit counts. Branch counts here are arrays per branch point, which is why converting to LCOV doubles the branch total if the array is not flattened. Every file in this group describes the same four-file source tree and reports 127/140 lines, 17/24 branch outcomes and 18/20 functions, so a converter can be diffed against a known answer.

The compact json-summary reporter output: a total block plus one block per file, each with lines, statements, functions and branches as total/covered/skipped/pct. This is what coverage badges and pull-request comments are generated from. Every file in this group describes the same four-file source tree and reports 127/140 lines, 17/24 branch outcomes and 18/20 functions, so a converter can be diffed against a known answer.

The threshold configuration the three boundary tracefiles in this group are meant to be judged against: global minimums, one per-path override and an explicit >= comparison. Publishing the comparison operator is the point — leaving it implicit is what makes an at-the-gate report ambiguous.

A five-request page load — document, stylesheet, script, image and favicon — across two fictional hosts, with full per-phase timings and an onLoad page timing. Every entry's time equals the sum of its non-negative timing phases, so a waterfall renderer can be checked arithmetically rather than by eye.

A four-call REST session against a fictional API host, with JSON request bodies in postData, an Authorization header carrying an obvious SAMPLE placeholder token, and a 204 response that has no body at all. The right shape for testing a HAR-to-mock-server or HAR-to-code converter.

An http URL that redirects to https and then to a query-carrying cart page, with redirectURL populated on both hops. Tools that count entries as page views report three here when the user saw one page.

Five failing requests covering authentication, authorisation, a missing resource, rate limiting with a Retry-After header, and a server error that returns HTML instead of the JSON the client asked for. The last one is the case that breaks clients which parse by status code rather than by content type.

A full session-cookie lifecycle: set at login, echoed on the next request, then expired at logout with Max-Age=0. Both the header and the parsed cookies array are present, and every value — including the form password field — is an obvious SAMPLE placeholder rather than a credential.

Four API calls in which the wait phase — time to first byte — accounts for almost all of the elapsed time, the signature of a server-bound rather than network-bound page. Use it to check that a performance report attributes the cost to the server instead of blaming connection setup.

One form submission whose postData carries both the parsed params array and the raw urlencoded text — and the two must agree. The notes field contains a comma and an ampersand, so a decoder that splits before unescaping produces seven fields instead of five.

A two-part multipart/form-data upload: a text file part with a fileName and a plain field part. The body uses CRLF between MIME parts because RFC 7578 requires it, even though the surrounding HAR document is LF-terminated — a distinction that matters when a replay tool rewrites the body.

A PNG response whose body is carried as base64 with content.encoding set accordingly. content.size is the DECODED byte count, not the length of the base64 string, which is the field readers most often get wrong when computing transfer weight.

A gzip-compressed JSON response where content.size is the uncompressed length, bodySize is the bytes on the wire, and content.compression is the saving between them. It also carries the non-standard _transferSize field browsers add, which readers must tolerate rather than reject.

Two navigations in one capture, with entries bound to their page through pageref. The second page's onLoad is -1, the HAR convention for a timing that never happened, which naive code averages in as zero and reports as an impossibly fast load.

A conditional request answered 304 with full beforeRequest and afterRequest cache state, next to a first-time fetch whose beforeRequest is null. The null is the documented way to say "not in the cache", and readers that treat it as a missing object rather than an explicit absence lose the distinction.

An HTTP/2 entry with lowercase pseudo-headers, an httpVersion of "h2" rather than "HTTP/2.0", an ssl phase inside connect, and three underscore-prefixed custom fields. Version strings are not standardised across writers, so anything matching on "HTTP/1.1" misses this entry entirely.

One request whose query string encodes a space as %20 in one parameter and as + in another, includes a parameter with an empty value, and carries an Accept-Language header with quality values. The parsed queryString array is the answer key for whatever a URL parser produces from the raw URL.

The machine twin of checkout.feature: the cucumber-messages envelope stream a runner emits, with meta, source, gherkinDocument, one pickle per expanded scenario, and paired testStepStarted/testStepFinished envelopes carrying nanosecond durations. Written as NDJSON because that is the format's actual wire shape — one envelope per line, not a JSON array.

The legacy cucumber.json report for the same run — the format nearly every BDD dashboard still ingests. Durations are in nanoseconds here and in a nested {seconds, nanos} object in the messages twin, which is the single most common unit bug when converting between the two.

One step of one scenario fails with an assertion message and a stack frame; every other step passes. In cucumber.json a scenario has no status of its own — it is failed if any of its steps is — so this file catches reporters that look for a scenario-level field that does not exist.

The three non-failure statuses BDD runners produce and dashboards routinely collapse into "failed": undefined (no step definition matched), pending (explicitly unimplemented) and skipped (never attempted). Whether the run is red depends on the runner's strict setting, which is exactly the decision this file forces.

The messages twin of the failing run: one testStepFinished carries status FAILED with both a human message and a structured exception object, and testRunFinished reports success false. Comparing it with the passing stream in the other group isolates exactly which envelopes a failure changes.

Playwright's native JSON report, four levels deep: suites contain specs, specs contain tests (one per project) and tests contain results (one per attempt). Its stats use expected/unexpected rather than passed/failed, because a test annotated as expected-to-fail counts as expected when it fails. Reports the same canonical run as the JUnit dialect files: 12 tests, 9 passed, 1 assertion failure, 1 error and 1 skip.

Jest's --json output, where skipped tests are called pending and the totals appear as flat numTotal/numPassed/numFailed fields alongside per-file assertionResults. Timestamps are epoch milliseconds rather than ISO strings, which is the field most converters mis-handle. Reports the same canonical run as the JUnit dialect files: 12 tests, 9 passed, 1 assertion failure, 1 error and 1 skip.

Mocha's JSON reporter, which lists every test in a tests array and then repeats each one in passes, failures or pending. Summing all four arrays counts the run twice — this file exists so that bug shows up on a 12-test suite instead of in production. Reports the same canonical run as the JUnit dialect files: 12 tests, 9 passed, 1 assertion failure, 1 error and 1 skip.

The pytest-json-report document, which records setup, call and teardown as three separate phases per test and keeps error distinct from failed in its summary. A test can pass its call phase and still error in teardown, which is why summing outcomes without reading the phases gives the wrong total. Reports the same canonical run as the JUnit dialect files: 12 tests, 9 passed, 1 assertion failure, 1 error and 1 skip.

A load-test run summary in the shape a threshold-checking CI step consumes: totals, per-scenario percentiles, and three named thresholds each carrying its limit, the observed value and a pass flag. Publishing the limit next to the observation is what lets a gate be re-evaluated without rerunning the test.

A budget file pairing per-path resource-size and timing limits with API latency budgets, including a glob path that must be matched rather than compared for equality. It is the configuration side of the load-test results in this group: the limits a run is judged against.

A complete OTLP/JSON trace export: one checkout request across five services as 13 spans, four levels deep, with HTTP, database, RPC and messaging semantic-convention attributes, span events and a producer span. Trace and span IDs are fixed, so ingesting it twice produces identical output.

The same 13-span trace serialised the way a stock proto3 JSON marshaller writes it: trace and span IDs base64-encoded and span kind and status as enum names rather than numbers. Paired with the hex/numeric OTLP/JSON twin so a receiver can be tested against both encodings of one payload.

The checkout trace in the Jaeger query-API shape — a data array holding one trace, spans carrying microsecond startTime and duration, CHILD_OF references, typed tags and a per-service processes map. The same span tree as the OTLP and Zipkin twins, so a converter can be scored exactly.

The checkout trace as a flat Zipkin v2 span list with localEndpoint, string-only tags and annotations. Two conversions are deliberately visible: Zipkin has no INTERNAL kind, so those two spans omit kind, and every typed attribute is stringified.

A failed checkout: an upstream payment timeout sets ERROR status on four spans up the chain and attaches an exception event whose exception.stacktrace attribute holds a real multi-line Python traceback with embedded newlines. The fixture for error grouping, status propagation and multi-line attribute rendering.

The consumer half of the checkout flow, in its own trace. Its root CONSUMER span carries a link — not a parent reference — back to the producer span in the checkout trace, which is how a batching consumer joins work produced elsewhere. A fixture for link resolution and cross-trace navigation.

One span carrying every OTLP AnyValue kind — string (plain, Unicode, multi-line, empty), int64 encoded as a JSON string, double, bool, array, nested kvlist and base64 bytes. Includes an integer above 2^53 to catch decoders that route int64 through a JavaScript number.

A single-service trace 48 levels deep — a recursive GraphQL-style resolver where every span is the child of the one before it. A depth fixture for waterfall renderers, tree-layout code and any parser that recurses over parentage.

One root span with 60 overlapping children — a scatter-gather query across database shards. The counterpart to the deep-chain fixture: shallow but very wide, which is what breaks waterfall layouts that assume spans do not overlap in time.

Two hosts whose clocks disagree by 12 ms, so a server span appears to start before the client span that called it. Nothing in the payload is malformed — this is the most common real cause of a negative-latency gap in a waterfall, and viewers must show it rather than crash or silently reorder.

The canonical checkout trace with its spans emitted in the order they finished — children before parents, deepest first. This is what a real batch exporter produces, and a consumer that assumes parents arrive first will drop or orphan most of the trace.

The checkout trace with one intermediate span dropped, as happens when an exporter's queue overflows. Three spans now reference a parent that is not in the payload — a partial trace that a store must render rather than reject.

Two traces streamed as newline-delimited OTLP requests, one resource per line, so a single trace is split across several lines exactly as a line-oriented collector sink writes it. A fixture for streaming ingestion, back-pressure and partial-trace assembly.

An OTLP/JSON export cut off in the middle of an object, the way a file sink looks when the collector is killed mid-write. This file is intentionally corrupt and small: it exists so an ingestion path can be tested for a clean parse error with a byte offset instead of a hang or a half-committed batch.

A structurally valid OTLP export containing no spans at all — what an exporter sends when every span in the interval was sampled out. The empty-input case that ingestion code routinely mistakes for an error.

A trace annotated with the sampling decision that let it through — sampler type and ratio on every span, plus a sampling.priority override on the root. The fixture for testing that a tail-sampling processor reads the existing decision instead of re-deciding and splitting the trace.

The service map you get by aggregating the trace fixtures in this category — five service nodes and the edges between them with call counts and latency percentiles, including the messaging edge that exists only because of a span link. Ground truth for a service-graph processor.

Histogram buckets carrying exemplars whose trace_id and span_id resolve against the OTLP trace fixtures in this category — the exact-to-example link that turns a latency spike on a graph into a specific request. Five exemplars, each with its own observed value and timestamp.

An OTLP metrics export with a monotonic cumulative sum and two gauges, showing the parts of the wire format that trip parsers: int data points serialised as JSON strings, UCUM unit annotations like {request} and By, and the start timestamp that makes a counter reset detectable.

An OTLP explicit-bucket histogram over the same latency distribution as the Prometheus fixture — but with per-bucket counts rather than cumulative ones, and one more bucket count than bounds. Converting between the two is where most OTLP-to-Prometheus bridges get the arithmetic wrong.

An exponential histogram at scale 3 — eight buckets per power of two — with a negative offset, a zero bucket and its threshold. Bucket i covers (base^(offset+i), base^(offset+i+1)], and getting that indexing wrong silently shifts every percentile, which is what this fixture is for.

The OTLP summary type — quantiles computed on the client, kept only for translating legacy Prometheus summaries. It carries the same four quantiles as the Prometheus summary fixture, and like that one it cannot be re-aggregated across instances without producing a wrong number.

An OTLP histogram carrying two exemplars, each with the trace and span ID of a request that landed in that bucket — including the 2.0031-second outlier that corresponds to the failed payment in the error-trace fixture. The metrics-to-traces jump, with a resolvable target.

A Prometheus /api/v1/query_range response: three labelled series of 30 points each at a 60-second step, with sample values as JSON strings and timestamps as float seconds. The exact envelope a dashboard client has to unpack, including the string-typed values that break naive charting code.

An instant-query response: five up series at a single evaluation timestamp, one of them zero, plus a warnings array that clients routinely ignore. A successful response can carry warnings, and dropping them hides truncated results.

The metadata endpoint's response, where each metric name maps to a list because different targets can disagree. http_requests_total here has two conflicting HELP strings — the real-world state that a metric catalogue or documentation generator has to resolve rather than assume away.

Three hundred newline-delimited JSON log records from five services, each with a timestamp, level, logger, message, a nested http object and request and order identifiers. The severity mix is counted in the spec table, so a level filter can be asserted rather than eyeballed.

One log record per span of the canonical checkout trace, each carrying trace_id, span_id, parent_span_id and trace flags. The logs-to-traces jump with a target that actually exists in this catalog, so a correlation query can be verified end to end.

Records whose objects declare the same key twice, including one where the duplicate changes the severity from debug to error. RFC 8259 permits duplicate names and leaves the outcome undefined, so last-wins and first-wins parsers disagree about what these records say.

One record nested 24 levels deep, one with 200 sibling keys and one holding a 12 by 12 array of arrays. Field-flattening pipelines turn these into hundreds of dotted keys, and depth limits truncate them silently — this is where both behaviours become visible.

An OTLP logs export across two resources: five records spanning DEBUG to FATAL with both severityNumber and severityText, separate event and observed timestamps, trace and span correlation, and one record whose body is a full multi-line Python traceback.

The same five OTLP log records reframed as one self-contained export per line, with the resource attributes repeated on every line. The trade a line-oriented sink makes: each line stands alone, at the cost of repeating the resource block five times.

Forty service-mesh proxy access records with the fields that make mesh debugging possible: response_flags distinguishing an upstream failure from an overflow, upstream_service_time against total duration, upstream host and cluster, and a request ID for correlation.

Six Kubernetes audit events at two audit levels, including one 403 whose authorization annotations record the forbid decision and its reason. The shape a cluster-audit alert or compliance report reads, with every user and service account invented.

A speedscope sampled profile: one shared frame table with source locations, then stacks expressed as arrays of frame indices with per-sample weights in nanoseconds. The index indirection is the whole design, and resolving it wrong produces a plausible but wrong flamegraph.

The evented half of the speedscope format — explicit O and C events that must nest like brackets, rather than sampled stacks. Tracing profilers emit this shape, and an unbalanced or out-of-order close is the corruption a loader has to detect.

The .cpuprofile shape V8 emits: a node tree with call frames, a samples array of node IDs and a parallel timeDeltas array, plus the synthesized (idle), (program) and (garbage collector) nodes. Counting those synthetic frames as application time is the classic misreading.

The folded CPU profile after aggregation into the nested name, value and children hierarchy that d3-flame-graph and most web viewers consume. Every node's value equals its own self time plus its children's, which is the invariant a converter must preserve.

The JSON body Alertmanager POSTs to a webhook when an alert fires, including the detail that catches everyone: endsAt is Go's zero time rather than null or absent, so a receiver that parses it as a real timestamp records an alert that ended in the year 1.

The resolved notification for the same alert half an hour later, carrying an identical fingerprint and group key with endsAt now populated. Paired with the firing payload so incident-tracking code can be tested for correctly closing the incident it opened.

One notification carrying twelve grouped alerts with truncatedAlerts set to 8, meaning twenty were firing. Receivers that count the alerts array report a smaller incident than actually exists — the field is there precisely so that does not have to happen.

A dashboard document in the Grafana JSON model: five panels on the 24-column grid, each with a datasource reference by UID, a PromQL target and a unit. Three panels query the recording rules in this category, so the dashboard and the rule file can be validated against each other.

A dashboard driven by four template variables, one of which queries using the value of another — the chained dependency that must be resolved in order. Multi-select variables interpolate as regex alternations, which is why every query here uses =~ rather than =.

Sixteen state transitions across four alerts, each moving inactive to pending to firing to resolved with the previous state recorded. The pending stage is where a for: duration is being served and no notification is sent, which is what makes alert-noise analysis possible.

A complete CycloneDX 1.6 SBOM in JSON for a fictional application and its nine dependencies, with purls, SHA-256 hashes, supplier records, external references and an explicit dependency graph. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX 1.5 SBOM of the same fictional tree, useful for spec-version migration tests: 1.5 introduced the object form of metadata.tools and this file uses it, while dropping the 1.6-only external references. Every package, version, hash and licence is fictional — the tree describes nothing real.

The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX 1.6 SBOM that carries its own vulnerabilities array — four clearly-marked SAMPLE advisories in the invented NOVUS-SAMPLE namespace, with CVSS v3.1 vectors, CWE classes and affected version ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX SBOM whose root component is an OCI container image rather than an application, mixing a fictional operating-system package with language packages — the shape an image scanner emits. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX SBOM that uses compound SPDX licence expressions — AND, OR, WITH and a LicenseRef — instead of plain licence ids, for testing compliance scanners that must evaluate the expression grammar. Every package, version, hash and licence is fictional — the tree describes nothing real.

Every fictional component in this CycloneDX SBOM carries three hash algorithms and five external-reference types (distribution, vcs, issue-tracker, documentation, build-system). Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX SBOM that declares external services and composition completeness alongside components — the sections tools most often skip. Both services are fictional endpoints on the .example domain. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CycloneDX SBOM whose author names and properties contain accented Latin, CJK, right-to-left Hebrew, emoji and a deliberately long property value — for testing encoding handling and field-width assumptions. Every package, version, hash and licence is fictional — the tree describes nothing real.

An intentionally corrupt CycloneDX SBOM: a valid 1.6 document cut off mid-object so the JSON never closes. Small on purpose — it exists to check that a reader fails cleanly instead of half-loading a component list. Every package, version, hash and licence is fictional — the tree describes nothing real.

An intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX 2.3 SBOM in JSON describing the same fictional tree as the CycloneDX documents in this category, with SPDXIDs, purl external references, SHA-256 checksums and DESCRIBES/DEPENDS_ON relationships. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX 2.3 JSON SBOM that uses the snippet section to attribute a fictional vendored fragment inside a file to a different licence, with both byte-offset and line-number ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX 3.0 SBOM in JSON-LD — the element-graph model that replaced the 2.x document layout — describing the same fictional tree with software_Package elements and typed Relationship nodes. Every package, version, hash and licence is fictional — the tree describes nothing real.

An npm lockfile in the modern v3 layout: a flat packages map keyed by node_modules path, with resolved tarball URLs and sha512 subresource integrity for nine fictional dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.

The transitional npm v2 lockfile, which carries BOTH the v3 packages map and the legacy nested dependencies tree describing the same fictional install — the case where a parser must not double-count. Every package, version, hash and licence is fictional — the tree describes nothing real.

The original npm v1 lockfile layout — a nested dependencies object with requires maps and no packages section — still found in long-lived repositories and needed by any migration path. Every package, version, hash and licence is fictional — the tree describes nothing real.

The shrinkwrap variant of an npm lockfile — identical in structure to package-lock.json but published inside the package tarball, so tooling that keys on the filename must handle both. Every package, version, hash and licence is fictional — the tree describes nothing real.

An intentionally invalid npm lockfile: two fictional packages carry sha512 integrity strings that cannot match their resolved tarballs — one derived from the wrong version, one a padded placeholder. Every package, version, hash and licence is fictional — the tree describes nothing real.

An npm lockfile where the fictional example-cache pins a peer of example-logger@2.9.0 while the rest of the tree resolves 3.4.1, forcing a nested node_modules duplicate — the shape a deduplication report must detect. Every package, version, hash and licence is fictional — the tree describes nothing real.

Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Pipenv lockfile in JSON, with the _meta hash that ties it to its Pipfile, a named index source and nine fictional pinned packages in the default section. Every package, version, hash and licence is fictional — the tree describes nothing real.

A PHP composer.lock in JSON, pinning each fictional package by both a git reference and a dist zip shasum, with a content-hash binding it to composer.json. Every package, version, hash and licence is fictional — the tree describes nothing real.

A NuGet lockfile keyed by target framework, distinguishing Direct from Transitive entries and recording a base64 contentHash for each fictional package. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Trivy-shaped filesystem scan report with four SAMPLE findings against a fictional npm lockfile, one per severity band, each with a CVSS v3.1 vector, CWE class and fixed version. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A Trivy-shaped image report with three result blocks — OS packages, language packages and a Dockerfile misconfiguration — so a parser must handle a Results array whose members have different keys. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A clean scan report — the case dashboards get wrong. Trivy omits the Vulnerabilities key entirely rather than emitting an empty array, so a reader that assumes the key exists throws on a passing build. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

The same four SAMPLE findings expressed as SARIF 2.1.0 — the format code-scanning dashboards ingest — with a rules array, security-severity properties and physical locations. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An intentionally corrupt scanner report: a valid Trivy-shaped JSON document cut off inside the first finding, for testing that a CI gate fails the build rather than reporting zero vulnerabilities. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A Grype-shaped report of the same four SAMPLE advisories, with the match detail block that explains WHY each package matched — the field that makes false positives diagnosable. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A single OSV-schema advisory record for a fictional package, with a SEMVER range expressed as introduced/fixed events rather than as a version string — the part naive parsers get wrong. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

All four SAMPLE advisories as newline-delimited OSV records — the bulk shape an advisory database is loaded from, where each line must parse independently. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An OSV-Scanner report that nests full OSV records under each affected package and adds the groups array that collapses aliases into one finding — the structure de-duplication depends on. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An intentionally invalid OSV record: the JSON parses, but the required id is missing, modified is not an RFC 3339 timestamp, the SEMVER range has a fixed event with no introduced event, and severity.score is a number where the schema demands a CVSS vector string. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An npm audit v2 report keyed by package name, with the via chain, the effects list showing which fictional parents are impacted, and npm's own severity vocabulary where MEDIUM is spelled 'moderate'. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

The legacy npm audit shape — numeric advisory ids, a separate actions array and dependency paths written with '>' — which tools built for the v2 report silently read as zero findings. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A pip-audit report for the fictional Python packages. It deliberately carries no severity field — pip-audit does not assign one — which is the case a severity gate must handle without defaulting to critical. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A cargo-audit report that shows three findings while a fourth is on the ignore list, plus an unmaintained-crate warning — so a gate must decide whether warnings count against it. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A Dependency-Check-shaped JSON report, including the evidence-collection block that records how a package was identified and the confidence attached to that identification. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A CycloneDX VEX document asserting a different analysis state for each of the four SAMPLE advisories, so a suppression pipeline can be tested against every branch at once. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An OpenVEX document covering all four status values, with the justification and impact statement OpenVEX requires alongside not_affected and the action statement it requires alongside affected. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

A CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

An unsigned in-toto Statement carrying a SLSA v1 provenance predicate for a fictional release: build definition, external parameters, resolved dependencies with digests, and run details naming an invented builder. Every package, version, hash and licence is fictional — the tree describes nothing real.

The predecessor predicate: SLSA v0.2 uses invocation/materials/buildConfig where v1 uses buildDefinition/runDetails, so this file is the migration test for any verifier that must accept both. Every package, version, hash and licence is fictional — the tree describes nothing real.

A DSSE envelope whose base64 payload decodes to the SLSA v1 statement in this family — the wrapper attestation tooling actually transports. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

An intentionally corrupt DSSE envelope: the JSON parses and the signature block looks complete, but the payload is truncated and contains characters outside the base64 alphabet. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

A VSA — the attestation a verifier issues so downstream consumers do not have to re-verify the whole chain — recording a PASSED result against a fictional SLSA L3 policy and the level distribution of dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.

An in-toto link file recording one build step: the materials that went in, the products that came out and their sha256 digests, wrapped in the signed/signatures envelope in-toto uses. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

The policy half of in-toto: a layout declaring which steps must run, which keys may sign them, and the MATCH/CREATE/DISALLOW artifact rules that bind each step's products to the next step's materials. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

A Sigstore bundle in the shape verifiers read: a SAMPLE certificate, a transparency-log entry with an inclusion proof and checkpoint, and the DSSE envelope carrying the provenance. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

A transparency-log entry keyed by its own UUID at the top level — a shape that breaks parsers expecting a fixed root key — with a base64 body that decodes to a dsse record. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

An attestation that binds an SBOM to an artifact digest rather than shipping the SBOM loose — the pattern keyless signing produces, complete with the empty keyid that identity-based signing leaves behind. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

An in-toto statement whose predicate is an entire SPDX 2.3 document — the nesting that makes attestation payloads large and that a size-limited verifier has to cope with. Every package, version, hash and licence is fictional — the tree describes nothing real.

Two independent builds of the same fictional artifact on different architectures, both producing one digest — the evidence a rebuilder publishes, with SOURCE_DATE_EPOCH recorded as the thing that made it possible. Every package, version, hash and licence is fictional — the tree describes nothing real.

The plain build record a CI job writes next to its artifacts — source ref and commit, builder identity, timings, toolchain versions and output digests — from which a provenance statement can be generated. Every package, version, hash and licence is fictional — the tree describes nothing real.

An explicit node/edge dependency graph with in-degree, out-degree and depth precomputed, plus a diamonds array naming the two shared nodes and their parents — the reference answer for any graph builder run against the SBOMs and lockfiles here. Every package, version, hash and licence is fictional — the tree describes nothing real.

A dependency graph containing a genuine three-node cycle between fictional plugins — the fixture that makes a naive recursive walker hang or blow the stack, with the cycle path stated so the expected answer is unambiguous. Every package, version, hash and licence is fictional — the tree describes nothing real.

The nested tree `npm ls --json` prints, where a shared dependency is REPEATED under every parent rather than deduplicated — so counting objects gives a larger number than the graph has nodes. Every package, version, hash and licence is fictional — the tree describes nothing real.

pipdeptree output, whose top level is an ARRAY rather than an object — the shape that breaks a loader written against npm's tree — with both installed and required versions on every edge. Every package, version, hash and licence is fictional — the tree describes nothing real.

The master dataset for this category: five towns, three roads, three parcels (one with a courtyard hole), a lake with an island, a buoy MultiPoint and the county boundary, as an RFC 7946 FeatureCollection. Kestrel Bay County is invented: open ocean at 47 N / 12.5 W, matching no real place, settlement, road or parcel.

The same 14 features with every optional byte of whitespace removed. Pair it with the pretty-printed master to test that a parser's output is whitespace-independent and that a formatter round-trips without reordering members.

The territory as one GeoJSON Feature per line, the shape streaming pipelines and BigQuery/Athena loaders expect. There is no enclosing FeatureCollection, so a reader that insists on one will reject it.

The territory as TopoJSON with no quantization and no transform, so arc coordinates are the raw WGS 84 positions. Decoding it must reproduce the master GeoJSON exactly — which makes it the reference case before the quantized fixtures introduce rounding.

A one-feature FeatureCollection holding a single position, so a reader can be exercised on Point in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding three harbour buoys, so a reader can be exercised on MultiPoint in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding the four-vertex Coast Road, so a reader can be exercised on LineString in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding all three roads as one geometry, so a reader can be exercised on MultiLineString in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding a simple four-corner parcel, so a reader can be exercised on Polygon in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding a parcel with a courtyard cut out of it, so a reader can be exercised on Polygon in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A one-feature FeatureCollection holding the three parcels as one geometry, so a reader can be exercised on MultiPolygon in isolation. Coordinates come from the Kestrel Bay territory, so the same shape appears again in every other format in this category.

A single Feature whose geometry is a GeometryCollection of a Point, a LineString and a Polygon. Many simple readers flatten or silently drop these, and many writers cannot produce them at all, so it is the usual place a conversion loses data.

RFC 7946 permits `"geometry": null` for a feature with attributes but no location. Readers that assume every feature has coordinates crash here, and writers that emit an empty Point instead corrupt the record's meaning.

A top-level Geometry object with no Feature or FeatureCollection around it. This is legal GeoJSON and is what PostGIS `ST_AsGeoJSON` returns, but a surprising number of importers only accept a FeatureCollection.

One Feature at the top level, with properties and an id but no enclosing collection — the shape a single-record API response takes. Pair it with the bare-geometry fixture to find readers that only handle one of the three legal root types.

A structurally valid FeatureCollection with an empty `features` array — what a spatial query legitimately returns when nothing matches. It is the standard fixture for the empty-state path of a map component.

All seven RFC 7946 geometry types in a single FeatureCollection. Formats with a single-geometry-type-per-layer model — shapefile, most database tables — cannot hold this in one layer, so it is the fixture that reveals how a converter splits or refuses it.

RFC 7946 section 6 allows members it does not define to sit alongside the ones it does, and requires parsers to ignore rather than reject them. This collection carries three such members at the top level.

The five towns with a four-element bounding box on the collection, ordered west, south, east, north as RFC 7946 requires. The values are the true extent of the contained points, so a reader that recomputes the box can be scored against the declared one.

Three features that each carry their own bbox. Spatial indexes are often built from these declared boxes instead of the geometry, so a wrong or stale one produces a query that silently misses features.

Five features whose `id` is a string and sits on the Feature itself rather than inside `properties` — the placement RFC 7946 specifies and the one most CSV-shaped importers get wrong by flattening it into an attribute.

The same five towns keyed by numeric ids. RFC 7946 allows an id to be either a string or a number, and code that assumes one type breaks on the other — usually by stringifying 1 into "1" and then failing to match on a later join.

One feature with `"properties": {}`, one with `"properties": null` and one fully populated. Both empty forms are legal, and attribute-table writers routinely fall over on the null form when they try to enumerate its keys.

One feature whose properties mix every JSON type and nest three levels deep. Formats with a flat attribute table — shapefile DBF, most SQL layers — cannot represent this, so the fixture shows whether a converter flattens, JSON-encodes, or discards the nested values.

Four features whose labels are written in Latin with diacritics, katakana, right-to-left Arabic, and a decomposed combining sequence — all stored as raw UTF-8 rather than \u escapes. Shapefile DBF export is where these usually turn into question marks.

A feature carrying a LineString with an empty coordinate array. Empty geometries are what spatial operations legitimately return — an intersection that misses, a clip that removes everything — and index and rendering code routinely assumes at least one coordinate exists.

A feature carrying a Polygon with no rings at all. Empty geometries are what spatial operations legitimately return — an intersection that misses, a clip that removes everything — and index and rendering code routinely assumes at least one coordinate exists.

A GeometryCollection with an empty `geometries` array — structurally valid, semantically the empty geometry. Converters that map a collection onto a multi-geometry type usually emit null here, quietly changing the record's meaning.

Four positions with a third element, which RFC 7946 defines as height in metres above the WGS 84 ellipsoid. Two-dimensional pipelines commonly truncate the third element without saying so, and this file is what proves whether yours does.

The full territory quantized onto a 10,000-step grid with a transform block and delta-encoded arc positions — the default TopoJSON encoding. Rounding is bounded by the grid spacing, which over this 0.28-degree extent is about 2.2 m.

Two adjacent parcels that share their common boundary as a single arc: West Field references it as 0 and East Field as ~0, the negative-index form that means traverse it backwards. Storing the boundary once is the whole point of TopoJSON, and it is also where naive decoders produce gaps or slivers.

One topology carrying three separately named objects — towns, roads and areas — that all index into the same arc pool. This is how a single TopoJSON file ships what would otherwise be three layers, and readers that assume exactly one object silently show only the first.

Five town geometries that each carry both an `id` member and a `properties` object. TopoJSON keeps these separate, and converters that fold the id into properties (or drop it) break joins against an external attribute table.

Exactly what the shared-arc topology decodes to: two polygons whose rings are stitched from arcs 0, 1 and 2 with arc 0 reversed for the eastern parcel. Because that file is unquantized, this comparison is exact rather than tolerance-based.

The five towns in EPSG:4326 — the geographic source, in longitude/latitude degrees. All three files hold the same five places, so reprojecting any one of them and diffing against another scores your transform against a known answer rather than against another implementation of the same library.

The five towns in EPSG:3857 — Web Mercator, the projection every slippy map renders in. All three files hold the same five places, so reprojecting any one of them and diffing against another scores your transform against a known answer rather than against another implementation of the same library.

The five towns in EPSG:4087 — World Equidistant Cylindrical, whose closed form can be checked by hand. All three files hold the same five places, so reprojecting any one of them and diffing against another scores your transform against a known answer rather than against another implementation of the same library.

The same harbour light written to 1 decimal place — enough to identify which country you are in. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

The same harbour light written to 2 decimal places — enough to identify which town you are in. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

The same harbour light written to 4 decimal places — enough to identify which building you are in. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

The same harbour light written to 6 decimal places — enough to identify which doorway you are standing in. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

The same harbour light written to 9 decimal places — enough to identify far finer than any consumer receiver can fix. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

The same harbour light written to 15 decimal places — enough to identify beyond what a float64 can hold for a coordinate at all. The ladder exists because coordinate precision is almost always chosen by accident, and shipping six unnecessary digits multiplies the size of every geometry in a tileset.

Five features whose coordinates are the values that break naive JSON number handling: 17-significant-digit doubles, the classic 0.1 + 0.2 artefact, the largest float64 below 180, a 1e-7 offset, and coordinates written in exponent form. Re-serialising this file is where a parser quietly loses or gains a digit.

GML calls a multipolygon a MultiSurface and its parts surfaceMembers, and nests exterior and interior rings under named elements rather than relying on ring order. This feature holds the holed lake and a solid parcel in one geometry, which is the shape a WFS response usually takes.

GeoJSON semantic target for the five-town shapefile set, preserving point order, CODE/NAME/POP/FOUNDED attributes, and longitude/latitude coordinates; the omitted .cpg is safe because every copied DBF value is ASCII. Stable P8 artifact p8-convert-shapefile-geojson.

A CustomResourceDefinition carrying a deep structural OpenAPI v3 schema with a regex pattern, an enum, a default, and array minItems. Useful both as a CRD fixture and as a nested JSON-Schema-in-YAML validation target.

The values.schema.json that validates the paired Helm values files: a 2020-12 JSON Schema with $defs, $ref, enums, quantity patterns, and additionalProperties: false on nested objects. Validates the defaults and rejects a values file with an unknown image key.

A Terraform plan JSON document with create, update and delete changes, after_unknown markers, sensitivity annotations, and a configuration section. This is the artifact policy engines read before anything runs, which is why it sits with pipeline definitions rather than with run reports.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.