Add some test data for TC-4427 created by Phil and AI

etc/test-data/cyclonedx/ai/TC-4427/ComponentLevelExternalBOMReference/README

@@ -0,0 +1,11 @@
+Recommended Directory Layout:
+
+    sboms/
+    ├── medical-scribe-app/
+    │   └── 5.0.0/
+    │       └── medical-scribe-app-5.0.0.sbom.json
+    │
+    └── aiboms/
+        └── scribe-gpt-medical/
+            └── 2026.05/
+                └── scribe-gpt-medical-2026.05.aibom.json

etc/test-data/cyclonedx/ai/TC-4427/ComponentLevelExternalBOMReference/medical-scribe-app-5.0.0.sbom.json

@@ -0,0 +1,70 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "serialNumber": "urn:uuid:9e2aa7c3-62cb-4f41-9e4f-111111111111",
+
+  "metadata": {
+    "timestamp": "2026-05-14T12:00:00Z",
+    "component": {
+      "type": "application",
+      "name": "medical-scribe-app",
+      "version": "5.0.0",
+      "bom-ref": "medical-scribe-app"
+    }
+  },
+
+  "components": [
+    {
+      "type": "application",
+      "name": "medical-scribe-app",
+      "version": "5.0.0",
+      "bom-ref": "medical-scribe-app",
+      "purl": "pkg:docker/acme/medical-scribe-app@5.0.0"
+    },
+
+    {
+      "type": "library",
+      "name": "fastapi",
+      "version": "0.115.0",
+      "bom-ref": "fastapi-lib",
+      "purl": "pkg:pypi/fastapi@0.115.0"
+    },
+
+    {
+      "type": "library",
+      "name": "transformers",
+      "version": "4.41.2",
+      "bom-ref": "transformers-lib",
+      "purl": "pkg:pypi/transformers@4.41.2"
+    },
+
+    {
+      "type": "machine-learning-model",
+      "name": "scribe-gpt-medical",
+      "version": "2026.05",
+      "bom-ref": "scribe-model",
+
+      "description": "External medical transcription and summarization model",
+
+      "externalReferences": [
+        {
+          "type": "bom",
+          "url": "./scribe-gpt-medical-2026.05.aibom.cdx.json",
+          "comment": "External AIBOM describing the AI model supply chain"
+        }
+      ]
+    }
+  ],
+
+  "dependencies": [
+    {
+      "ref": "medical-scribe-app",
+      "dependsOn": [
+        "fastapi-lib",
+        "transformers-lib",
+        "scribe-model"
+      ]
+    }
+  ]
+}

etc/test-data/cyclonedx/ai/TC-4427/ComponentLevelExternalBOMReference/scribe-gpt-medical-2026.05.aibom.json

@@ -0,0 +1,109 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 3,
+  "serialNumber": "urn:uuid:5ab8e98b-3b35-44d5-92d9-222222222222",
+
+  "metadata": {
+    "timestamp": "2026-05-14T12:00:00Z",
+
+    "component": {
+      "type": "machine-learning-model",
+      "name": "scribe-gpt-medical",
+      "version": "2026.05",
+      "bom-ref": "scribe-model"
+    },
+
+    "authors": [
+      {
+        "name": "Acme AI Research"
+      }
+    ]
+  },
+
+  "components": [
+    {
+      "type": "machine-learning-model",
+      "name": "scribe-gpt-medical",
+      "version": "2026.05",
+      "bom-ref": "scribe-model",
+
+      "publisher": "Acme AI Research",
+
+      "description": "Fine-tuned medical summarization and transcription model",
+
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+
+      "properties": [
+        {
+          "name": "model:architecture",
+          "value": "Llama-derived Transformer"
+        },
+        {
+          "name": "model:parameters",
+          "value": "13B"
+        },
+        {
+          "name": "model:framework",
+          "value": "PyTorch"
+        },
+        {
+          "name": "model:precision",
+          "value": "fp16"
+        },
+        {
+          "name": "model:context-window",
+          "value": "32768"
+        },
+        {
+          "name": "model:fine-tuned-from",
+          "value": "llama3-13b"
+        }
+      ],
+
+      "externalReferences": [
+        {
+          "type": "model-card",
+          "url": "https://models.acme.example/scribe-gpt-medical/model-card"
+        }
+      ]
+    },
+
+    {
+      "type": "data",
+      "name": "medical-transcripts-training-dataset",
+      "version": "2026-Q1",
+      "bom-ref": "training-dataset",
+
+      "properties": [
+        {
+          "name": "dataset:source",
+          "value": "Curated anonymized transcripts"
+        }
+      ]
+    },
+
+    {
+      "type": "data",
+      "name": "medical-tokenizer",
+      "version": "3.1",
+      "bom-ref": "medical-tokenizer"
+    }
+  ],
+
+  "dependencies": [
+    {
+      "ref": "scribe-model",
+      "dependsOn": [
+        "training-dataset",
+        "medical-tokenizer"
+      ]
+    }
+  ]
+}

etc/test-data/cyclonedx/ai/TC-4427/CycloneDXBOM-LinkCross-BOMreferences/README

@@ -0,0 +1,36 @@
+Understanding the BOM-Link URN
+
+The key line is:
+{
+  "url": "urn:cdx:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/2"
+}
+
+
+This means:
+
+Part                                    Meaning
+====                                    =======
+urn:cdx:                                CycloneDX BOM-Link namespace
+aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee    Target BOM serial number UUID
+/2                                      BOM version
+
+The referenced BOM must therefore contain:
+{
+  "serialNumber": "urn:uuid:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+  "version": 2
+}
+
+This creates a deterministic immutable link.
+
+Recommended Repository Layout
+
+    sboms/
+    ├── applications/
+    │   └── advisor-chatbot/
+    │       └── 1.9.0/
+    │           └── advisor-chatbot-1.9.0.sbom.json
+    │
+    └── aiboms/
+        └── advisor-llm/
+            └── 8.1/
+                └── advisor-llm-8.1.aibom.json

etc/test-data/cyclonedx/ai/TC-4427/CycloneDXBOM-LinkCross-BOMreferences/advisor-chatbot-1.9.0.sbom.json

@@ -0,0 +1,68 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+
+  "serialNumber": "urn:uuid:11111111-2222-3333-4444-555555555555",
+
+  "metadata": {
+    "timestamp": "2026-05-14T12:00:00Z",
+
+    "component": {
+      "type": "application",
+      "name": "advisor-chatbot",
+      "version": "1.9.0",
+      "bom-ref": "advisor-chatbot-app"
+    }
+  },
+
+  "components": [
+    {
+      "type": "application",
+      "name": "advisor-chatbot",
+      "version": "1.9.0",
+      "bom-ref": "advisor-chatbot-app",
+
+      "purl": "pkg:docker/acme/advisor-chatbot@1.9.0"
+    },
+
+    {
+      "type": "library",
+      "name": "langchain",
+      "version": "0.3.0",
+      "bom-ref": "langchain-lib",
+
+      "purl": "pkg:pypi/langchain@0.3.0"
+    },
+
+    {
+      "type": "machine-learning-model",
+      "name": "advisor-llm",
+      "version": "8.1",
+      "bom-ref": "advisor-llm-component",
+
+      "description": "Enterprise advisory language model",
+
+      "externalReferences": [
+        {
+          "type": "bom",
+
+          "url": "urn:cdx:aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee/2",
+
+          "comment": "BOM-Link reference to the external AI BOM"
+        }
+      ]
+    }
+  ],
+
+  "dependencies": [
+    {
+      "ref": "advisor-chatbot-app",
+
+      "dependsOn": [
+        "langchain-lib",
+        "advisor-llm-component"
+      ]
+    }
+  ]
+}