feat: Implement Filesystem and MongoDB provenance writers for PackRun execution context

- Added `FilesystemPackRunProvenanceWriter` to write provenance manifests to the filesystem.
- Introduced `MongoPackRunArtifactReader` to read artifacts from MongoDB.
- Created `MongoPackRunProvenanceWriter` to store provenance manifests in MongoDB.
- Developed unit tests for filesystem and MongoDB provenance writers.
- Established `ITimelineEventStore` and `ITimelineIngestionService` interfaces for timeline event handling.
- Implemented `TimelineIngestionService` to validate and persist timeline events with hashing.
- Created PostgreSQL schema and migration scripts for timeline indexing.
- Added dependency injection support for timeline indexer services.
- Developed tests for timeline ingestion and schema validation.

bench/reachability-benchmark/cases/py/flask-template/case.yaml

@@ -0,0 +1,38 @@
+id: "py-flask-template:103"
+language: py
+project: flask-template
+version: "1.0.0"
+description: "Template rendering reachable via POST /render"
+entrypoints:
+  - "POST /render"
+sinks:
+  - id: "FlaskTemplate::render"
+    path: "src/app.py::handle_request"
+    kind: "http"
+    location:
+      file: src/app.py
+      line: 5
+    notes: "template replace on user input"
+environment:
+  os_image: "python:3.12-alpine"
+  runtime:
+    python: "3.12"
+  source_date_epoch: 1730000000
+build:
+  command: "./build/build.sh"
+  source_date_epoch: 1730000000
+  outputs:
+    artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
+    coverage_path: outputs/coverage.json
+    traces_dir: outputs/traces
+test:
+  command: "./tests/run-tests.sh"
+  expected_coverage:
+    - outputs/coverage.json
+  expected_traces:
+    - outputs/traces/traces.json
+ground_truth:
+  summary: "Template rendering reachable"
+  evidence_files:
+    - "../benchmark/truth/py-flask-template.json"

bench/reachability-benchmark/cases/py/flask-template/entrypoints.yaml

@@ -0,0 +1,8 @@
+case_id: "py-flask-template:103"
+entries:
+  http:
+    - id: "POST /render"
+      route: "/render"
+      method: "POST"
+      handler: "app.handle_request"
+      description: "Template rendering"

bench/reachability-benchmark/cases/py/flask-template/requirements.txt

@@ -0,0 +1 @@
+# stdlib only for this minimal case

bench/reachability-benchmark/cases/py/flask-template/src/app.py

@@ -0,0 +1,12 @@
+"""Minimal flask-like template rendering sink (reachable)."""
+
+def render(template: str, context: dict) -> str:
+    return template.replace("{{name}}", context.get("name", "guest"))
+
+def handle_request(body):
+    template = body.get("template") if isinstance(body, dict) else None
+    if not isinstance(template, str):
+        return {"status": 400, "body": "bad request"}
+    rendered = render(template, {"name": "guest"})
+    # Sink: returns rendered template (models potential SSTI)
+    return {"status": 200, "body": rendered}

bench/reachability-benchmark/cases/py/flask-template/tests/run-tests.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$0")"
+export SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-1730000000}
+export TZ=UTC
+export LC_ALL=C
+export PYTHONPATH="$(cd .. && pwd)/src"
+python test_reach.py

bench/reachability-benchmark/cases/py/flask-template/tests/test_reach.py

@@ -0,0 +1,48 @@
+import json
+import pathlib
+from app import handle_request
+
+ROOT = pathlib.Path(__file__).resolve().parent.parent
+OUT = ROOT / "outputs"
+TRACE_DIR = OUT / "traces"
+COVERAGE_FILE = OUT / "coverage.json"
+TRACE_FILE = TRACE_DIR / "traces.json"
+
+def ensure_dirs():
+    OUT.mkdir(parents=True, exist_ok=True)
+    TRACE_DIR.mkdir(parents=True, exist_ok=True)
+
+def record_trace(entry, path_nodes):
+    TRACE_FILE.write_text(
+        json.dumps({
+            "entry": entry,
+            "path": path_nodes,
+            "sink": "FlaskTemplate::render",
+            "notes": "Template rendered"
+        }, indent=2)
+    )
+
+def record_coverage(file_path, lines):
+    COVERAGE_FILE.write_text(
+        json.dumps({
+            "files": {
+                file_path: {
+                    "lines_covered": lines,
+                    "lines_total": 40
+                }
+            }
+        }, indent=2)
+    )
+
+def test_reach():
+    ensure_dirs()
+    res = handle_request({"template": "Hello {{name}}"})
+    assert res["status"] == 200
+    assert res["body"] == "Hello guest"
+    record_trace("POST /render", ["app.py::handle_request", "render"])
+    record_coverage("src/app.py", [4,5,6,8,9,10,11])
+    (OUT / "SINK_REACHED").write_text("true")
+
+
+if __name__ == "__main__":
+    test_reach()