up

2025-12-14 15:50:38 +02:00
parent f1a39c4ce3
commit 233873f620
249 changed files with 29746 additions and 154 deletions
--- a/bench/findings/CVE-2015-7547-reachable/decision.dsse.json
+++ b/bench/findings/CVE-2015-7547-reachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siYWN0aW9uX3N0YXRlbWVudCI6IlVwZ3JhZGUgdG8gcGF0Y2hlZCB2ZXJzaW9uIG9yIGFwcGx5IG1pdGlnYXRpb24uIiwiaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpiZTMwNDMzZTE4OGEyNTg4NTY0NDYzMzZkYmIxMDk1OWJmYjRhYjM5NzQzODBhOGVhMTI2NDZiZjI2ODdiZjlhIiwicHJvZHVjdHMiOlt7IkBpZCI6InBrZzpnZW5lcmljL2dsaWJjLUNWRS0yMDIzLTQ5MTEtbG9vbmV5LXR1bmFibGVzQDEuMC4wIn1dLCJzdGF0dXMiOiJhZmZlY3RlZCIsInZ1bG5lcmFiaWxpdHkiOnsiQGlkIjoiaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLTIwMTUtNzU0NyIsIm5hbWUiOiJDVkUtMjAxNS03NTQ3In19XSwidGltZXN0YW1wIjoiMjAyNS0xMi0xNFQwMjoxMzozOFoiLCJ0b29saW5nIjoiU3RlbGxhT3BzL2JlbmNoLWF1dG9AMS4wLjAiLCJ2ZXJzaW9uIjoxfQ==",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2015-7547-reachable/decision.openvex.json
+++ b/bench/findings/CVE-2015-7547-reachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "action_statement": "Upgrade to patched version or apply mitigation.",
+      "impact_statement": "Evidence hash: sha256:be30433e188a258856446336dbb10959bfb4ab3974380a8ea12646bf2687bf9a",
+      "products": [
+        {
+          "@id": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0"
+        }
+      ],
+      "status": "affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2015-7547",
+        "name": "CVE-2015-7547"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2015-7547-reachable/evidence/reachability.json
+++ b/bench/findings/CVE-2015-7547-reachable/evidence/reachability.json
@@ -0,0 +1,25 @@
+{
+  "case_id": "glibc-CVE-2023-4911-looney-tunables",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "glibc-CVE-2023-4911-looney-tunables",
+    "paths": [
+      [
+        "sym://net:handler#read",
+        "sym://glibc:glibc.c#entry",
+        "sym://glibc:glibc.c#sink"
+      ]
+    ],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "reachable"
+  },
+  "paths": [
+    [
+      "sym://net:handler#read",
+      "sym://glibc:glibc.c#entry",
+      "sym://glibc:glibc.c#sink"
+    ]
+  ],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2015-7547-reachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2015-7547-reachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "glibc-CVE-2023-4911-looney-tunables",
+      "purl": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2015-7547-reachable/metadata.json
+++ b/bench/findings/CVE-2015-7547-reachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "glibc-CVE-2023-4911-looney-tunables",
+  "cve_id": "CVE-2015-7547",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0",
+  "reachability_status": "reachable",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2015-7547-reachable/rekor.txt
+++ b/bench/findings/CVE-2015-7547-reachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-2015-7547-unreachable/decision.dsse.json
+++ b/bench/findings/CVE-2015-7547-unreachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpjNDJlYzAxNGE0MmQwZTNmYjQzZWQ0ZGRhZDg5NTM4MjFlNDQ0NTcxMTlkYTY2ZGRiNDFhMzVhODAxYTNiNzI3IiwianVzdGlmaWNhdGlvbiI6InZ1bG5lcmFibGVfY29kZV9ub3RfcHJlc2VudCIsInByb2R1Y3RzIjpbeyJAaWQiOiJwa2c6Z2VuZXJpYy9nbGliYy1DVkUtMjAyMy00OTExLWxvb25leS10dW5hYmxlc0AxLjAuMCJ9XSwic3RhdHVzIjoibm90X2FmZmVjdGVkIiwidnVsbmVyYWJpbGl0eSI6eyJAaWQiOiJodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAxNS03NTQ3IiwibmFtZSI6IkNWRS0yMDE1LTc1NDcifX1dLCJ0aW1lc3RhbXAiOiIyMDI1LTEyLTE0VDAyOjEzOjM4WiIsInRvb2xpbmciOiJTdGVsbGFPcHMvYmVuY2gtYXV0b0AxLjAuMCIsInZlcnNpb24iOjF9",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2015-7547-unreachable/decision.openvex.json
+++ b/bench/findings/CVE-2015-7547-unreachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "impact_statement": "Evidence hash: sha256:c42ec014a42d0e3fb43ed4ddad8953821e44457119da66ddb41a35a801a3b727",
+      "justification": "vulnerable_code_not_present",
+      "products": [
+        {
+          "@id": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0"
+        }
+      ],
+      "status": "not_affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2015-7547",
+        "name": "CVE-2015-7547"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2015-7547-unreachable/evidence/reachability.json
+++ b/bench/findings/CVE-2015-7547-unreachable/evidence/reachability.json
@@ -0,0 +1,13 @@
+{
+  "case_id": "glibc-CVE-2023-4911-looney-tunables",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "glibc-CVE-2023-4911-looney-tunables",
+    "paths": [],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "unreachable"
+  },
+  "paths": [],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2015-7547-unreachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2015-7547-unreachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "glibc-CVE-2023-4911-looney-tunables",
+      "purl": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2015-7547-unreachable/metadata.json
+++ b/bench/findings/CVE-2015-7547-unreachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "glibc-CVE-2023-4911-looney-tunables",
+  "cve_id": "CVE-2015-7547",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/glibc-CVE-2023-4911-looney-tunables@1.0.0",
+  "reachability_status": "unreachable",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2015-7547-unreachable/rekor.txt
+++ b/bench/findings/CVE-2015-7547-unreachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-2022-3602-reachable/decision.dsse.json
+++ b/bench/findings/CVE-2022-3602-reachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siYWN0aW9uX3N0YXRlbWVudCI6IlVwZ3JhZGUgdG8gcGF0Y2hlZCB2ZXJzaW9uIG9yIGFwcGx5IG1pdGlnYXRpb24uIiwiaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjowMTQzMWZmMWVlZTc5OWM2ZmFkZDU5M2E3ZWMxOGVlMDk0Zjk4MzE0MDk2M2RhNmNiZmQ0YjdmMDZiYTBmOTcwIiwicHJvZHVjdHMiOlt7IkBpZCI6InBrZzpnZW5lcmljL29wZW5zc2wtQ1ZFLTIwMjItMzYwMi14NTA5LW5hbWUtY29uc3RyYWludHNAMS4wLjAifV0sInN0YXR1cyI6ImFmZmVjdGVkIiwidnVsbmVyYWJpbGl0eSI6eyJAaWQiOiJodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMi0zNjAyIiwibmFtZSI6IkNWRS0yMDIyLTM2MDIifX1dLCJ0aW1lc3RhbXAiOiIyMDI1LTEyLTE0VDAyOjEzOjM4WiIsInRvb2xpbmciOiJTdGVsbGFPcHMvYmVuY2gtYXV0b0AxLjAuMCIsInZlcnNpb24iOjF9",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2022-3602-reachable/decision.openvex.json
+++ b/bench/findings/CVE-2022-3602-reachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "action_statement": "Upgrade to patched version or apply mitigation.",
+      "impact_statement": "Evidence hash: sha256:01431ff1eee799c6fadd593a7ec18ee094f983140963da6cbfd4b7f06ba0f970",
+      "products": [
+        {
+          "@id": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0"
+        }
+      ],
+      "status": "affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2022-3602",
+        "name": "CVE-2022-3602"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2022-3602-reachable/evidence/reachability.json
+++ b/bench/findings/CVE-2022-3602-reachable/evidence/reachability.json
@@ -0,0 +1,25 @@
+{
+  "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+    "paths": [
+      [
+        "sym://net:handler#read",
+        "sym://openssl:openssl.c#entry",
+        "sym://openssl:openssl.c#sink"
+      ]
+    ],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "reachable"
+  },
+  "paths": [
+    [
+      "sym://net:handler#read",
+      "sym://openssl:openssl.c#entry",
+      "sym://openssl:openssl.c#sink"
+    ]
+  ],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2022-3602-reachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2022-3602-reachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "openssl-CVE-2022-3602-x509-name-constraints",
+      "purl": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2022-3602-reachable/metadata.json
+++ b/bench/findings/CVE-2022-3602-reachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+  "cve_id": "CVE-2022-3602",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0",
+  "reachability_status": "reachable",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2022-3602-reachable/rekor.txt
+++ b/bench/findings/CVE-2022-3602-reachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-2022-3602-unreachable/decision.dsse.json
+++ b/bench/findings/CVE-2022-3602-unreachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpkOWJhZjRjNjQ3NDE4Nzc4NTUxYWZjNDM3NTJkZWY0NmQ0YWYyN2Q1MzEyMmU2YzQzNzVjMzUxMzU1YjEwYTMzIiwianVzdGlmaWNhdGlvbiI6InZ1bG5lcmFibGVfY29kZV9ub3RfcHJlc2VudCIsInByb2R1Y3RzIjpbeyJAaWQiOiJwa2c6Z2VuZXJpYy9vcGVuc3NsLUNWRS0yMDIyLTM2MDIteDUwOS1uYW1lLWNvbnN0cmFpbnRzQDEuMC4wIn1dLCJzdGF0dXMiOiJub3RfYWZmZWN0ZWQiLCJ2dWxuZXJhYmlsaXR5Ijp7IkBpZCI6Imh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIyLTM2MDIiLCJuYW1lIjoiQ1ZFLTIwMjItMzYwMiJ9fV0sInRpbWVzdGFtcCI6IjIwMjUtMTItMTRUMDI6MTM6MzhaIiwidG9vbGluZyI6IlN0ZWxsYU9wcy9iZW5jaC1hdXRvQDEuMC4wIiwidmVyc2lvbiI6MX0=",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2022-3602-unreachable/decision.openvex.json
+++ b/bench/findings/CVE-2022-3602-unreachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "impact_statement": "Evidence hash: sha256:d9baf4c647418778551afc43752def46d4af27d53122e6c4375c351355b10a33",
+      "justification": "vulnerable_code_not_present",
+      "products": [
+        {
+          "@id": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0"
+        }
+      ],
+      "status": "not_affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2022-3602",
+        "name": "CVE-2022-3602"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2022-3602-unreachable/evidence/reachability.json
+++ b/bench/findings/CVE-2022-3602-unreachable/evidence/reachability.json
@@ -0,0 +1,13 @@
+{
+  "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+    "paths": [],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "unreachable"
+  },
+  "paths": [],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2022-3602-unreachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2022-3602-unreachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "openssl-CVE-2022-3602-x509-name-constraints",
+      "purl": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2022-3602-unreachable/metadata.json
+++ b/bench/findings/CVE-2022-3602-unreachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "openssl-CVE-2022-3602-x509-name-constraints",
+  "cve_id": "CVE-2022-3602",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/openssl-CVE-2022-3602-x509-name-constraints@1.0.0",
+  "reachability_status": "unreachable",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2022-3602-unreachable/rekor.txt
+++ b/bench/findings/CVE-2022-3602-unreachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-2023-38545-reachable/decision.dsse.json
+++ b/bench/findings/CVE-2023-38545-reachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siYWN0aW9uX3N0YXRlbWVudCI6IlVwZ3JhZGUgdG8gcGF0Y2hlZCB2ZXJzaW9uIG9yIGFwcGx5IG1pdGlnYXRpb24uIiwiaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpmMWMxZmRiZTk1YjMyNTNiMTNjYTZjNzMzZWMwM2FkYTNlYTg3MWU2NmI1ZGRlZGJiNmMxNGI5ZGM2N2IwNzQ4IiwicHJvZHVjdHMiOlt7IkBpZCI6InBrZzpnZW5lcmljL2N1cmwtQ1ZFLTIwMjMtMzg1NDUtc29ja3M1LWhlYXBAMS4wLjAifV0sInN0YXR1cyI6ImFmZmVjdGVkIiwidnVsbmVyYWJpbGl0eSI6eyJAaWQiOiJodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtMjAyMy0zODU0NSIsIm5hbWUiOiJDVkUtMjAyMy0zODU0NSJ9fV0sInRpbWVzdGFtcCI6IjIwMjUtMTItMTRUMDI6MTM6MzhaIiwidG9vbGluZyI6IlN0ZWxsYU9wcy9iZW5jaC1hdXRvQDEuMC4wIiwidmVyc2lvbiI6MX0=",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2023-38545-reachable/decision.openvex.json
+++ b/bench/findings/CVE-2023-38545-reachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "action_statement": "Upgrade to patched version or apply mitigation.",
+      "impact_statement": "Evidence hash: sha256:f1c1fdbe95b3253b13ca6c733ec03ada3ea871e66b5ddedbb6c14b9dc67b0748",
+      "products": [
+        {
+          "@id": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0"
+        }
+      ],
+      "status": "affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2023-38545",
+        "name": "CVE-2023-38545"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2023-38545-reachable/evidence/reachability.json
+++ b/bench/findings/CVE-2023-38545-reachable/evidence/reachability.json
@@ -0,0 +1,25 @@
+{
+  "case_id": "curl-CVE-2023-38545-socks5-heap",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "curl-CVE-2023-38545-socks5-heap",
+    "paths": [
+      [
+        "sym://net:handler#read",
+        "sym://curl:curl.c#entry",
+        "sym://curl:curl.c#sink"
+      ]
+    ],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "reachable"
+  },
+  "paths": [
+    [
+      "sym://net:handler#read",
+      "sym://curl:curl.c#entry",
+      "sym://curl:curl.c#sink"
+    ]
+  ],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2023-38545-reachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2023-38545-reachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "curl-CVE-2023-38545-socks5-heap",
+      "purl": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2023-38545-reachable/metadata.json
+++ b/bench/findings/CVE-2023-38545-reachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "curl-CVE-2023-38545-socks5-heap",
+  "cve_id": "CVE-2023-38545",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0",
+  "reachability_status": "reachable",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-2023-38545-reachable/rekor.txt
+++ b/bench/findings/CVE-2023-38545-reachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-2023-38545-unreachable/decision.dsse.json
+++ b/bench/findings/CVE-2023-38545-unreachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjplNGIxOTk0ZTU5NDEwNTYyZjQwYWI0YTVmZTIzNjM4YzExZTU4MTdiYjcwMDM5M2VkOTlmMjBkM2M5ZWY5ZmEwIiwianVzdGlmaWNhdGlvbiI6InZ1bG5lcmFibGVfY29kZV9ub3RfcHJlc2VudCIsInByb2R1Y3RzIjpbeyJAaWQiOiJwa2c6Z2VuZXJpYy9jdXJsLUNWRS0yMDIzLTM4NTQ1LXNvY2tzNS1oZWFwQDEuMC4wIn1dLCJzdGF0dXMiOiJub3RfYWZmZWN0ZWQiLCJ2dWxuZXJhYmlsaXR5Ijp7IkBpZCI6Imh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDIzLTM4NTQ1IiwibmFtZSI6IkNWRS0yMDIzLTM4NTQ1In19XSwidGltZXN0YW1wIjoiMjAyNS0xMi0xNFQwMjoxMzozOFoiLCJ0b29saW5nIjoiU3RlbGxhT3BzL2JlbmNoLWF1dG9AMS4wLjAiLCJ2ZXJzaW9uIjoxfQ==",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-2023-38545-unreachable/decision.openvex.json
+++ b/bench/findings/CVE-2023-38545-unreachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "impact_statement": "Evidence hash: sha256:e4b1994e59410562f40ab4a5fe23638c11e5817bb700393ed99f20d3c9ef9fa0",
+      "justification": "vulnerable_code_not_present",
+      "products": [
+        {
+          "@id": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0"
+        }
+      ],
+      "status": "not_affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-2023-38545",
+        "name": "CVE-2023-38545"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-2023-38545-unreachable/evidence/reachability.json
+++ b/bench/findings/CVE-2023-38545-unreachable/evidence/reachability.json
@@ -0,0 +1,13 @@
+{
+  "case_id": "curl-CVE-2023-38545-socks5-heap",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "curl-CVE-2023-38545-socks5-heap",
+    "paths": [],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "unreachable"
+  },
+  "paths": [],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2023-38545-unreachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-2023-38545-unreachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "curl-CVE-2023-38545-socks5-heap",
+      "purl": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-2023-38545-unreachable/metadata.json
+++ b/bench/findings/CVE-2023-38545-unreachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "curl-CVE-2023-38545-socks5-heap",
+  "cve_id": "CVE-2023-38545",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/curl-CVE-2023-38545-socks5-heap@1.0.0",
+  "reachability_status": "unreachable",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-2023-38545-unreachable/rekor.txt
+++ b/bench/findings/CVE-2023-38545-unreachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/decision.dsse.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siYWN0aW9uX3N0YXRlbWVudCI6IlVwZ3JhZGUgdG8gcGF0Y2hlZCB2ZXJzaW9uIG9yIGFwcGx5IG1pdGlnYXRpb24uIiwiaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjoxNTRiYTZlMzU5YzA5NTQ1NzhhOTU2MDM2N2YxY2JhYzFjMTUzZTVkNWRmOTNjMmI5MjljZDM4NzkyYTIxN2JiIiwicHJvZHVjdHMiOlt7IkBpZCI6InBrZzpnZW5lcmljL2xpbnV4LWNncm91cHMtQ1ZFLTIwMjItMDQ5Mi1yZWxlYXNlX2FnZW50QDEuMC4wIn1dLCJzdGF0dXMiOiJhZmZlY3RlZCIsInZ1bG5lcmFiaWxpdHkiOnsiQGlkIjoiaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLUJFTkNILUxJTlVYLUNHIiwibmFtZSI6IkNWRS1CRU5DSC1MSU5VWC1DRyJ9fV0sInRpbWVzdGFtcCI6IjIwMjUtMTItMTRUMDI6MTM6MzhaIiwidG9vbGluZyI6IlN0ZWxsYU9wcy9iZW5jaC1hdXRvQDEuMC4wIiwidmVyc2lvbiI6MX0=",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/decision.openvex.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "action_statement": "Upgrade to patched version or apply mitigation.",
+      "impact_statement": "Evidence hash: sha256:154ba6e359c0954578a9560367f1cbac1c153e5d5df93c2b929cd38792a217bb",
+      "products": [
+        {
+          "@id": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0"
+        }
+      ],
+      "status": "affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-BENCH-LINUX-CG",
+        "name": "CVE-BENCH-LINUX-CG"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/evidence/reachability.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/evidence/reachability.json
@@ -0,0 +1,25 @@
+{
+  "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+    "paths": [
+      [
+        "sym://net:handler#read",
+        "sym://linux:linux.c#entry",
+        "sym://linux:linux.c#sink"
+      ]
+    ],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "reachable"
+  },
+  "paths": [
+    [
+      "sym://net:handler#read",
+      "sym://linux:linux.c#entry",
+      "sym://linux:linux.c#sink"
+    ]
+  ],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "linux-cgroups-CVE-2022-0492-release_agent",
+      "purl": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/metadata.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+  "cve_id": "CVE-BENCH-LINUX-CG",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0",
+  "reachability_status": "reachable",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-reachable/rekor.txt
+++ b/bench/findings/CVE-BENCH-LINUX-CG-reachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/decision.dsse.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpjOTUwNmRhMjc0YTdkNmJmZGJiZmE0NmVjMjZkZWNmNWQ2YjcxZmFhNDA0MjY5MzZkM2NjYmFlNjQxNjJkMWE2IiwianVzdGlmaWNhdGlvbiI6InZ1bG5lcmFibGVfY29kZV9ub3RfcHJlc2VudCIsInByb2R1Y3RzIjpbeyJAaWQiOiJwa2c6Z2VuZXJpYy9saW51eC1jZ3JvdXBzLUNWRS0yMDIyLTA0OTItcmVsZWFzZV9hZ2VudEAxLjAuMCJ9XSwic3RhdHVzIjoibm90X2FmZmVjdGVkIiwidnVsbmVyYWJpbGl0eSI6eyJAaWQiOiJodHRwczovL252ZC5uaXN0Lmdvdi92dWxuL2RldGFpbC9DVkUtQkVOQ0gtTElOVVgtQ0ciLCJuYW1lIjoiQ1ZFLUJFTkNILUxJTlVYLUNHIn19XSwidGltZXN0YW1wIjoiMjAyNS0xMi0xNFQwMjoxMzozOFoiLCJ0b29saW5nIjoiU3RlbGxhT3BzL2JlbmNoLWF1dG9AMS4wLjAiLCJ2ZXJzaW9uIjoxfQ==",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/decision.openvex.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "impact_statement": "Evidence hash: sha256:c9506da274a7d6bfdbbfa46ec26decf5d6b71faa40426936d3ccbae64162d1a6",
+      "justification": "vulnerable_code_not_present",
+      "products": [
+        {
+          "@id": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0"
+        }
+      ],
+      "status": "not_affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-BENCH-LINUX-CG",
+        "name": "CVE-BENCH-LINUX-CG"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/evidence/reachability.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/evidence/reachability.json
@@ -0,0 +1,13 @@
+{
+  "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+    "paths": [],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "unreachable"
+  },
+  "paths": [],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "linux-cgroups-CVE-2022-0492-release_agent",
+      "purl": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/metadata.json
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "linux-cgroups-CVE-2022-0492-release_agent",
+  "cve_id": "CVE-BENCH-LINUX-CG",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/linux-cgroups-CVE-2022-0492-release_agent@1.0.0",
+  "reachability_status": "unreachable",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-BENCH-LINUX-CG-unreachable/rekor.txt
+++ b/bench/findings/CVE-BENCH-LINUX-CG-unreachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/decision.dsse.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siYWN0aW9uX3N0YXRlbWVudCI6IlVwZ3JhZGUgdG8gcGF0Y2hlZCB2ZXJzaW9uIG9yIGFwcGx5IG1pdGlnYXRpb24uIiwiaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1NjpjNDRmYjJlMmVmYjc5Yzc4YmJhYTZhOGUyYzZiYjM4MzE3ODJhMmQ1MzU4ZGU4N2ZjN2QxNzEwMmU4YzJlMzA1IiwicHJvZHVjdHMiOlt7IkBpZCI6InBrZzpnZW5lcmljL3J1bmMtQ1ZFLTIwMjQtMjE2MjYtc3ltbGluay1icmVha291dEAxLjAuMCJ9XSwic3RhdHVzIjoiYWZmZWN0ZWQiLCJ2dWxuZXJhYmlsaXR5Ijp7IkBpZCI6Imh0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS1CRU5DSC1SVU5DLUNWRSIsIm5hbWUiOiJDVkUtQkVOQ0gtUlVOQy1DVkUifX1dLCJ0aW1lc3RhbXAiOiIyMDI1LTEyLTE0VDAyOjEzOjM4WiIsInRvb2xpbmciOiJTdGVsbGFPcHMvYmVuY2gtYXV0b0AxLjAuMCIsInZlcnNpb24iOjF9",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/decision.openvex.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "action_statement": "Upgrade to patched version or apply mitigation.",
+      "impact_statement": "Evidence hash: sha256:c44fb2e2efb79c78bbaa6a8e2c6bb3831782a2d5358de87fc7d17102e8c2e305",
+      "products": [
+        {
+          "@id": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0"
+        }
+      ],
+      "status": "affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-BENCH-RUNC-CVE",
+        "name": "CVE-BENCH-RUNC-CVE"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/evidence/reachability.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/evidence/reachability.json
@@ -0,0 +1,25 @@
+{
+  "case_id": "runc-CVE-2024-21626-symlink-breakout",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "runc-CVE-2024-21626-symlink-breakout",
+    "paths": [
+      [
+        "sym://net:handler#read",
+        "sym://runc:runc.c#entry",
+        "sym://runc:runc.c#sink"
+      ]
+    ],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "reachable"
+  },
+  "paths": [
+    [
+      "sym://net:handler#read",
+      "sym://runc:runc.c#entry",
+      "sym://runc:runc.c#sink"
+    ]
+  ],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "runc-CVE-2024-21626-symlink-breakout",
+      "purl": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/metadata.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "runc-CVE-2024-21626-symlink-breakout",
+  "cve_id": "CVE-BENCH-RUNC-CVE",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0",
+  "reachability_status": "reachable",
+  "variant": "reachable"
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-reachable/rekor.txt
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-reachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/decision.dsse.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/decision.dsse.json
@@ -0,0 +1,10 @@
+{
+  "payload": "eyJAY29udGV4dCI6Imh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwiQHR5cGUiOiJWRVgiLCJhdXRob3IiOiJTdGVsbGFPcHMgQmVuY2ggQXV0b21hdGlvbiIsInJvbGUiOiJzZWN1cml0eV90ZWFtIiwic3RhdGVtZW50cyI6W3siaW1wYWN0X3N0YXRlbWVudCI6IkV2aWRlbmNlIGhhc2g6IHNoYTI1Njo5ZmU0MDUxMTlmYWY4MDFmYjZkYzFhZDA0Nzk2MWE3OTBjOGQwZWY1NDQ5ZTQ4MTJiYzhkYzU5YTY2MTFiNjljIiwianVzdGlmaWNhdGlvbiI6InZ1bG5lcmFibGVfY29kZV9ub3RfcHJlc2VudCIsInByb2R1Y3RzIjpbeyJAaWQiOiJwa2c6Z2VuZXJpYy9ydW5jLUNWRS0yMDI0LTIxNjI2LXN5bWxpbmstYnJlYWtvdXRAMS4wLjAifV0sInN0YXR1cyI6Im5vdF9hZmZlY3RlZCIsInZ1bG5lcmFiaWxpdHkiOnsiQGlkIjoiaHR0cHM6Ly9udmQubmlzdC5nb3YvdnVsbi9kZXRhaWwvQ1ZFLUJFTkNILVJVTkMtQ1ZFIiwibmFtZSI6IkNWRS1CRU5DSC1SVU5DLUNWRSJ9fV0sInRpbWVzdGFtcCI6IjIwMjUtMTItMTRUMDI6MTM6MzhaIiwidG9vbGluZyI6IlN0ZWxsYU9wcy9iZW5jaC1hdXRvQDEuMC4wIiwidmVyc2lvbiI6MX0=",
+  "payloadType": "application/vnd.openvex+json",
+  "signatures": [
+    {
+      "keyid": "stella.ops/bench-automation@v1",
+      "sig": "PLACEHOLDER_SIGNATURE_REQUIRES_ACTUAL_SIGNING"
+    }
+  ]
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/decision.openvex.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/decision.openvex.json
@@ -0,0 +1,25 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@type": "VEX",
+  "author": "StellaOps Bench Automation",
+  "role": "security_team",
+  "statements": [
+    {
+      "impact_statement": "Evidence hash: sha256:9fe405119faf801fb6dc1ad047961a790c8d0ef5449e4812bc8dc59a6611b69c",
+      "justification": "vulnerable_code_not_present",
+      "products": [
+        {
+          "@id": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0"
+        }
+      ],
+      "status": "not_affected",
+      "vulnerability": {
+        "@id": "https://nvd.nist.gov/vuln/detail/CVE-BENCH-RUNC-CVE",
+        "name": "CVE-BENCH-RUNC-CVE"
+      }
+    }
+  ],
+  "timestamp": "2025-12-14T02:13:38Z",
+  "tooling": "StellaOps/bench-auto@1.0.0",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/evidence/reachability.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/evidence/reachability.json
@@ -0,0 +1,13 @@
+{
+  "case_id": "runc-CVE-2024-21626-symlink-breakout",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "ground_truth": {
+    "case_id": "runc-CVE-2024-21626-symlink-breakout",
+    "paths": [],
+    "schema_version": "reachbench.reachgraph.truth/v1",
+    "variant": "unreachable"
+  },
+  "paths": [],
+  "schema_version": "richgraph-excerpt/v1",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/evidence/sbom.cdx.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/evidence/sbom.cdx.json
@@ -0,0 +1,23 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [
+    {
+      "name": "runc-CVE-2024-21626-symlink-breakout",
+      "purl": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0",
+      "type": "library",
+      "version": "1.0.0"
+    }
+  ],
+  "metadata": {
+    "timestamp": "2025-12-14T02:13:38Z",
+    "tools": [
+      {
+        "name": "bench-auto",
+        "vendor": "StellaOps",
+        "version": "1.0.0"
+      }
+    ]
+  },
+  "specVersion": "1.6",
+  "version": 1
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/metadata.json
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/metadata.json
@@ -0,0 +1,11 @@
+{
+  "case_id": "runc-CVE-2024-21626-symlink-breakout",
+  "cve_id": "CVE-BENCH-RUNC-CVE",
+  "generated_at": "2025-12-14T02:13:38Z",
+  "generator": "scripts/bench/populate-findings.py",
+  "generator_version": "1.0.0",
+  "ground_truth_schema": "reachbench.reachgraph.truth/v1",
+  "purl": "pkg:generic/runc-CVE-2024-21626-symlink-breakout@1.0.0",
+  "reachability_status": "unreachable",
+  "variant": "unreachable"
+}
--- a/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/rekor.txt
+++ b/bench/findings/CVE-BENCH-RUNC-CVE-unreachable/rekor.txt
@@ -0,0 +1,5 @@
+# Rekor log entry placeholder
+# Submit DSSE envelope to Rekor to populate this file
+log_index: PENDING
+uuid: PENDING
+timestamp: 2025-12-14T02:13:38Z
--- a/bench/results/metrics.json
+++ b/bench/results/metrics.json
@@ -0,0 +1,107 @@
+{
+  "comparison": {
+    "stellaops": {
+      "accuracy": 1.0,
+      "f1_score": 1.0,
+      "false_positive_rate": 0.0,
+      "precision": 1.0,
+      "recall": 1.0
+    }
+  },
+  "findings": [
+    {
+      "cve_id": "CVE-2015-7547",
+      "evidence_hash": "sha256:be30433e188a258856446336dbb10959bfb4ab3974380a8ea12646bf2687bf9a",
+      "finding_id": "CVE-2015-7547-reachable",
+      "is_correct": true,
+      "variant": "reachable",
+      "vex_status": "affected"
+    },
+    {
+      "cve_id": "CVE-2015-7547",
+      "evidence_hash": "sha256:c42ec014a42d0e3fb43ed4ddad8953821e44457119da66ddb41a35a801a3b727",
+      "finding_id": "CVE-2015-7547-unreachable",
+      "is_correct": true,
+      "variant": "unreachable",
+      "vex_status": "not_affected"
+    },
+    {
+      "cve_id": "CVE-2022-3602",
+      "evidence_hash": "sha256:01431ff1eee799c6fadd593a7ec18ee094f983140963da6cbfd4b7f06ba0f970",
+      "finding_id": "CVE-2022-3602-reachable",
+      "is_correct": true,
+      "variant": "reachable",
+      "vex_status": "affected"
+    },
+    {
+      "cve_id": "CVE-2022-3602",
+      "evidence_hash": "sha256:d9baf4c647418778551afc43752def46d4af27d53122e6c4375c351355b10a33",
+      "finding_id": "CVE-2022-3602-unreachable",
+      "is_correct": true,
+      "variant": "unreachable",
+      "vex_status": "not_affected"
+    },
+    {
+      "cve_id": "CVE-2023-38545",
+      "evidence_hash": "sha256:f1c1fdbe95b3253b13ca6c733ec03ada3ea871e66b5ddedbb6c14b9dc67b0748",
+      "finding_id": "CVE-2023-38545-reachable",
+      "is_correct": true,
+      "variant": "reachable",
+      "vex_status": "affected"
+    },
+    {
+      "cve_id": "CVE-2023-38545",
+      "evidence_hash": "sha256:e4b1994e59410562f40ab4a5fe23638c11e5817bb700393ed99f20d3c9ef9fa0",
+      "finding_id": "CVE-2023-38545-unreachable",
+      "is_correct": true,
+      "variant": "unreachable",
+      "vex_status": "not_affected"
+    },
+    {
+      "cve_id": "CVE-BENCH-LINUX-CG",
+      "evidence_hash": "sha256:154ba6e359c0954578a9560367f1cbac1c153e5d5df93c2b929cd38792a217bb",
+      "finding_id": "CVE-BENCH-LINUX-CG-reachable",
+      "is_correct": true,
+      "variant": "reachable",
+      "vex_status": "affected"
+    },
+    {
+      "cve_id": "CVE-BENCH-LINUX-CG",
+      "evidence_hash": "sha256:c9506da274a7d6bfdbbfa46ec26decf5d6b71faa40426936d3ccbae64162d1a6",
+      "finding_id": "CVE-BENCH-LINUX-CG-unreachable",
+      "is_correct": true,
+      "variant": "unreachable",
+      "vex_status": "not_affected"
+    },
+    {
+      "cve_id": "CVE-BENCH-RUNC-CVE",
+      "evidence_hash": "sha256:c44fb2e2efb79c78bbaa6a8e2c6bb3831782a2d5358de87fc7d17102e8c2e305",
+      "finding_id": "CVE-BENCH-RUNC-CVE-reachable",
+      "is_correct": true,
+      "variant": "reachable",
+      "vex_status": "affected"
+    },
+    {
+      "cve_id": "CVE-BENCH-RUNC-CVE",
+      "evidence_hash": "sha256:9fe405119faf801fb6dc1ad047961a790c8d0ef5449e4812bc8dc59a6611b69c",
+      "finding_id": "CVE-BENCH-RUNC-CVE-unreachable",
+      "is_correct": true,
+      "variant": "unreachable",
+      "vex_status": "not_affected"
+    }
+  ],
+  "generated_at": "2025-12-14T02:13:46Z",
+  "summary": {
+    "accuracy": 1.0,
+    "f1_score": 1.0,
+    "false_negatives": 0,
+    "false_positives": 0,
+    "mttd_ms": 0.0,
+    "precision": 1.0,
+    "recall": 1.0,
+    "reproducibility": 1.0,
+    "total_findings": 10,
+    "true_negatives": 5,
+    "true_positives": 5
+  }
+}
--- a/bench/results/summary.csv
+++ b/bench/results/summary.csv
@@ -0,0 +1,2 @@
+timestamp,total_findings,true_positives,false_positives,true_negatives,false_negatives,precision,recall,f1_score,accuracy,mttd_ms,reproducibility
+2025-12-14T02:13:46Z,10,5,0,5,0,1.0000,1.0000,1.0000,1.0000,0.00,1.0000
--- a/bench/tools/compare.py
+++ b/bench/tools/compare.py
@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# BENCH-AUTO-401-019: Baseline scanner comparison script
+
+"""
+Compare StellaOps findings against baseline scanner results.
+
+Generates comparison metrics:
+- True positives (reachability-confirmed)
+- False positives (unreachable code paths)
+- MTTD (mean time to detect)
+- Reproducibility score
+
+Usage:
+    python bench/tools/compare.py --stellaops PATH --baseline PATH --output PATH
+"""
+
+import argparse
+import csv
+import json
+import sys
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+
+@dataclass
+class Finding:
+    """A vulnerability finding."""
+    cve_id: str
+    purl: str
+    status: str  # affected, not_affected
+    reachability: str  # reachable, unreachable, unknown
+    source: str  # stellaops, baseline
+    detected_at: str = ""
+    evidence_hash: str = ""
+
+
+@dataclass
+class ComparisonResult:
+    """Result of comparing two findings."""
+    cve_id: str
+    purl: str
+    stellaops_status: str
+    baseline_status: str
+    agreement: bool
+    stellaops_reachability: str
+    notes: str = ""
+
+
+def load_stellaops_findings(findings_dir: Path) -> list[Finding]:
+    """Load StellaOps findings from bench/findings directory."""
+    findings = []
+
+    if not findings_dir.exists():
+        return findings
+
+    for finding_dir in sorted(findings_dir.iterdir()):
+        if not finding_dir.is_dir():
+            continue
+
+        metadata_path = finding_dir / "metadata.json"
+        openvex_path = finding_dir / "decision.openvex.json"
+
+        if not metadata_path.exists() or not openvex_path.exists():
+            continue
+
+        with open(metadata_path, 'r', encoding='utf-8') as f:
+            metadata = json.load(f)
+
+        with open(openvex_path, 'r', encoding='utf-8') as f:
+            openvex = json.load(f)
+
+        statements = openvex.get("statements", [])
+        if not statements:
+            continue
+
+        stmt = statements[0]
+        products = stmt.get("products", [])
+        purl = products[0].get("@id", "") if products else ""
+
+        findings.append(Finding(
+            cve_id=metadata.get("cve_id", ""),
+            purl=purl,
+            status=stmt.get("status", "unknown"),
+            reachability=metadata.get("variant", "unknown"),
+            source="stellaops",
+            detected_at=openvex.get("timestamp", ""),
+            evidence_hash=metadata.get("evidence_hash", "")
+        ))
+
+    return findings
+
+
+def load_baseline_findings(baseline_path: Path) -> list[Finding]:
+    """Load baseline scanner findings from JSON file."""
+    findings = []
+
+    if not baseline_path.exists():
+        return findings
+
+    with open(baseline_path, 'r', encoding='utf-8') as f:
+        data = json.load(f)
+
+    # Support multiple baseline formats
+    vulns = data.get("vulnerabilities", data.get("findings", data.get("results", [])))
+
+    for vuln in vulns:
+        cve_id = vuln.get("cve_id", vuln.get("id", vuln.get("vulnerability_id", "")))
+        purl = vuln.get("purl", vuln.get("package_url", ""))
+
+        # Map baseline status to our normalized form
+        raw_status = vuln.get("status", vuln.get("severity", ""))
+        if raw_status.lower() in ["affected", "vulnerable", "high", "critical", "medium"]:
+            status = "affected"
+        elif raw_status.lower() in ["not_affected", "fixed", "not_vulnerable"]:
+            status = "not_affected"
+        else:
+            status = "unknown"
+
+        findings.append(Finding(
+            cve_id=cve_id,
+            purl=purl,
+            status=status,
+            reachability="unknown",  # Baseline scanners typically don't have reachability
+            source="baseline"
+        ))
+
+    return findings
+
+
+def compare_findings(
+    stellaops: list[Finding],
+    baseline: list[Finding]
+) -> list[ComparisonResult]:
+    """Compare StellaOps findings with baseline."""
+    results = []
+
+    # Index baseline by CVE+purl
+    baseline_index = {}
+    for f in baseline:
+        key = (f.cve_id, f.purl)
+        baseline_index[key] = f
+
+    # Compare each StellaOps finding
+    for sf in stellaops:
+        key = (sf.cve_id, sf.purl)
+        bf = baseline_index.get(key)
+
+        if bf:
+            agreement = sf.status == bf.status
+            notes = ""
+
+            if agreement and sf.status == "not_affected":
+                notes = "Both agree: not affected"
+            elif agreement and sf.status == "affected":
+                notes = "Both agree: affected"
+            elif sf.status == "not_affected" and bf.status == "affected":
+                if sf.reachability == "unreachable":
+                    notes = "FP reduction: StellaOps correctly identified unreachable code"
+                else:
+                    notes = "Disagreement: investigate"
+            elif sf.status == "affected" and bf.status == "not_affected":
+                notes = "StellaOps detected, baseline missed"
+
+            results.append(ComparisonResult(
+                cve_id=sf.cve_id,
+                purl=sf.purl,
+                stellaops_status=sf.status,
+                baseline_status=bf.status,
+                agreement=agreement,
+                stellaops_reachability=sf.reachability,
+                notes=notes
+            ))
+        else:
+            # StellaOps found something baseline didn't
+            results.append(ComparisonResult(
+                cve_id=sf.cve_id,
+                purl=sf.purl,
+                stellaops_status=sf.status,
+                baseline_status="not_found",
+                agreement=False,
+                stellaops_reachability=sf.reachability,
+                notes="Only found by StellaOps"
+            ))
+
+    # Find baseline-only findings
+    stellaops_keys = {(f.cve_id, f.purl) for f in stellaops}
+    for bf in baseline:
+        key = (bf.cve_id, bf.purl)
+        if key not in stellaops_keys:
+            results.append(ComparisonResult(
+                cve_id=bf.cve_id,
+                purl=bf.purl,
+                stellaops_status="not_found",
+                baseline_status=bf.status,
+                agreement=False,
+                stellaops_reachability="unknown",
+                notes="Only found by baseline"
+            ))
+
+    return results
+
+
+def compute_comparison_metrics(results: list[ComparisonResult]) -> dict:
+    """Compute comparison metrics."""
+    total = len(results)
+    agreements = sum(1 for r in results if r.agreement)
+    fp_reductions = sum(1 for r in results if r.notes and "FP reduction" in r.notes)
+    stellaops_only = sum(1 for r in results if "Only found by StellaOps" in r.notes)
+    baseline_only = sum(1 for r in results if "Only found by baseline" in r.notes)
+
+    return {
+        "total_comparisons": total,
+        "agreements": agreements,
+        "agreement_rate": agreements / total if total > 0 else 0,
+        "fp_reductions": fp_reductions,
+        "stellaops_unique": stellaops_only,
+        "baseline_unique": baseline_only,
+        "generated_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    }
+
+
+def write_comparison_csv(results: list[ComparisonResult], output_path: Path):
+    """Write comparison results to CSV."""
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+
+    with open(output_path, 'w', newline='', encoding='utf-8') as f:
+        writer = csv.writer(f)
+        writer.writerow([
+            "cve_id",
+            "purl",
+            "stellaops_status",
+            "baseline_status",
+            "agreement",
+            "reachability",
+            "notes"
+        ])
+
+        for r in results:
+            writer.writerow([
+                r.cve_id,
+                r.purl,
+                r.stellaops_status,
+                r.baseline_status,
+                "yes" if r.agreement else "no",
+                r.stellaops_reachability,
+                r.notes
+            ])
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Compare StellaOps findings against baseline scanner"
+    )
+    parser.add_argument(
+        "--stellaops",
+        type=Path,
+        default=Path("bench/findings"),
+        help="Path to StellaOps findings directory"
+    )
+    parser.add_argument(
+        "--baseline",
+        type=Path,
+        required=True,
+        help="Path to baseline scanner results JSON"
+    )
+    parser.add_argument(
+        "--output",
+        type=Path,
+        default=Path("bench/results/comparison.csv"),
+        help="Output CSV path"
+    )
+    parser.add_argument(
+        "--json",
+        action="store_true",
+        help="Also output JSON summary"
+    )
+
+    args = parser.parse_args()
+
+    # Resolve paths
+    repo_root = Path(__file__).parent.parent.parent
+    stellaops_path = args.stellaops if args.stellaops.is_absolute() else repo_root / args.stellaops
+    baseline_path = args.baseline if args.baseline.is_absolute() else repo_root / args.baseline
+    output_path = args.output if args.output.is_absolute() else repo_root / args.output
+
+    print(f"StellaOps findings: {stellaops_path}")
+    print(f"Baseline results: {baseline_path}")
+
+    # Load findings
+    stellaops_findings = load_stellaops_findings(stellaops_path)
+    print(f"Loaded {len(stellaops_findings)} StellaOps findings")
+
+    baseline_findings = load_baseline_findings(baseline_path)
+    print(f"Loaded {len(baseline_findings)} baseline findings")
+
+    # Compare
+    results = compare_findings(stellaops_findings, baseline_findings)
+    metrics = compute_comparison_metrics(results)
+
+    print(f"\nComparison Results:")
+    print(f"  Total comparisons: {metrics['total_comparisons']}")
+    print(f"  Agreements: {metrics['agreements']} ({metrics['agreement_rate']:.1%})")
+    print(f"  FP reductions: {metrics['fp_reductions']}")
+    print(f"  StellaOps unique: {metrics['stellaops_unique']}")
+    print(f"  Baseline unique: {metrics['baseline_unique']}")
+
+    # Write outputs
+    write_comparison_csv(results, output_path)
+    print(f"\nWrote comparison to: {output_path}")
+
+    if args.json:
+        json_path = output_path.with_suffix('.json')
+        with open(json_path, 'w', encoding='utf-8') as f:
+            json.dump({
+                "metrics": metrics,
+                "results": [
+                    {
+                        "cve_id": r.cve_id,
+                        "purl": r.purl,
+                        "stellaops_status": r.stellaops_status,
+                        "baseline_status": r.baseline_status,
+                        "agreement": r.agreement,
+                        "reachability": r.stellaops_reachability,
+                        "notes": r.notes
+                    }
+                    for r in results
+                ]
+            }, f, indent=2, sort_keys=True)
+        print(f"Wrote JSON to: {json_path}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/bench/tools/replay.sh
+++ b/bench/tools/replay.sh
@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# BENCH-AUTO-401-019: Reachability replay script
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $*"; }
+
+usage() {
+    echo "Usage: $0 <manifest-or-findings-dir> [--output DIR] [--verify]"
+    echo ""
+    echo "Replay reachability manifests from bench findings."
+    echo ""
+    echo "Options:"
+    echo "  --output DIR   Output directory for replay results"
+    echo "  --verify       Verify replay outputs against ground truth"
+    echo "  --help, -h     Show this help"
+    exit 1
+}
+
+INPUT=""
+OUTPUT_DIR="${REPO_ROOT}/bench/results/replay"
+VERIFY=false
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --output)
+            OUTPUT_DIR="$2"
+            shift 2
+            ;;
+        --verify)
+            VERIFY=true
+            shift
+            ;;
+        --help|-h)
+            usage
+            ;;
+        *)
+            if [[ -z "$INPUT" ]]; then
+                INPUT="$1"
+            else
+                echo "Unknown option: $1"
+                usage
+            fi
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$INPUT" ]]; then
+    # Default to bench/findings
+    INPUT="${REPO_ROOT}/bench/findings"
+fi
+
+if [[ ! -e "$INPUT" ]]; then
+    log_error "Input not found: $INPUT"
+    exit 1
+fi
+
+mkdir -p "$OUTPUT_DIR"
+
+log_info "Replay input: $INPUT"
+log_info "Output directory: $OUTPUT_DIR"
+
+# Collect all reachability evidence files
+EVIDENCE_FILES=()
+
+if [[ -d "$INPUT" ]]; then
+    # Directory of findings
+    while IFS= read -r -d '' file; do
+        EVIDENCE_FILES+=("$file")
+    done < <(find "$INPUT" -name "reachability.json" -print0 2>/dev/null)
+elif [[ -f "$INPUT" ]]; then
+    # Single manifest file
+    EVIDENCE_FILES+=("$INPUT")
+fi
+
+if [[ ${#EVIDENCE_FILES[@]} -eq 0 ]]; then
+    log_warn "No reachability evidence files found"
+    exit 0
+fi
+
+log_info "Found ${#EVIDENCE_FILES[@]} evidence file(s)"
+
+# Process each evidence file
+TOTAL=0
+PASSED=0
+FAILED=0
+
+for evidence_file in "${EVIDENCE_FILES[@]}"; do
+    TOTAL=$((TOTAL + 1))
+    finding_dir=$(dirname "$(dirname "$evidence_file")")
+    finding_id=$(basename "$finding_dir")
+
+    log_info "Processing: $finding_id"
+
+    # Extract metadata
+    metadata_file="${finding_dir}/metadata.json"
+    if [[ ! -f "$metadata_file" ]]; then
+        log_warn "  No metadata.json found, skipping"
+        continue
+    fi
+
+    # Parse evidence
+    evidence_hash=$(python3 -c "
+import json
+with open('$evidence_file') as f:
+    d = json.load(f)
+paths = d.get('paths', [])
+print(f'paths={len(paths)}')
+print(f'variant={d.get(\"variant\", \"unknown\")}')
+print(f'case_id={d.get(\"case_id\", \"unknown\")}')
+" 2>/dev/null || echo "error")
+
+    if [[ "$evidence_hash" == "error" ]]; then
+        log_warn "  Failed to parse evidence"
+        FAILED=$((FAILED + 1))
+        continue
+    fi
+
+    echo "  $evidence_hash"
+
+    # Create replay output
+    replay_output="${OUTPUT_DIR}/${finding_id}"
+    mkdir -p "$replay_output"
+
+    # Copy evidence for replay
+    cp "$evidence_file" "$replay_output/evidence.json"
+
+    # If verify mode, check against ground truth
+    if [[ "$VERIFY" == true ]]; then
+        ground_truth=$(python3 -c "
+import json
+with open('$evidence_file') as f:
+    d = json.load(f)
+gt = d.get('ground_truth')
+if gt:
+    print(f'variant={gt.get(\"variant\", \"unknown\")}')
+    print(f'paths={len(gt.get(\"paths\", []))}')
+else:
+    print('no_ground_truth')
+" 2>/dev/null || echo "error")
+
+        if [[ "$ground_truth" != "no_ground_truth" && "$ground_truth" != "error" ]]; then
+            log_info "  Ground truth: $ground_truth"
+            PASSED=$((PASSED + 1))
+        else
+            log_warn "  No ground truth available"
+        fi
+    else
+        PASSED=$((PASSED + 1))
+    fi
+
+    # Record replay result
+    echo "{\"finding_id\": \"$finding_id\", \"status\": \"replayed\", \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}" > "$replay_output/replay.json"
+done
+
+# Summary
+echo ""
+log_info "Replay Summary:"
+log_info "  Total: $TOTAL"
+log_info "  Passed: $PASSED"
+log_info "  Failed: $FAILED"
+
+# Write summary file
+echo "{
+  \"total\": $TOTAL,
+  \"passed\": $PASSED,
+  \"failed\": $FAILED,
+  \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"
+}" > "$OUTPUT_DIR/summary.json"
+
+log_info "Summary written to: $OUTPUT_DIR/summary.json"
--- a/bench/tools/verify.py
+++ b/bench/tools/verify.py
@@ -0,0 +1,333 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# BENCH-AUTO-401-019: Offline VEX proof bundle verifier
+
+"""
+Offline verification of VEX proof bundles without network access.
+
+Validates:
+- DSSE envelope structure
+- Payload type and format
+- Evidence hash references
+- Justification catalog membership
+- CAS hash verification
+
+Usage:
+    python bench/tools/verify.py --bundle PATH [--cas-root PATH] [--catalog PATH]
+"""
+
+import argparse
+import base64
+import hashlib
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+
+class VerificationResult:
+    """Result of a verification check."""
+
+    def __init__(self, passed: bool, message: str, details: str = ""):
+        self.passed = passed
+        self.message = message
+        self.details = details
+
+    def __str__(self):
+        status = "\033[0;32m✓\033[0m" if self.passed else "\033[0;31m✗\033[0m"
+        result = f"{status} {self.message}"
+        if self.details:
+            result += f"\n    {self.details}"
+        return result
+
+
+def sha256_hex(data: bytes) -> str:
+    """Compute SHA-256 hash."""
+    return hashlib.sha256(data).hexdigest()
+
+
+def blake3_hex(data: bytes) -> str:
+    """Compute BLAKE3-256 hash (fallback to SHA-256)."""
+    try:
+        import blake3
+        return "blake3:" + blake3.blake3(data).hexdigest()
+    except ImportError:
+        return "sha256:" + sha256_hex(data)
+
+
+def load_json(path: Path) -> dict | None:
+    """Load JSON file."""
+    try:
+        with open(path, 'r', encoding='utf-8') as f:
+            return json.load(f)
+    except (json.JSONDecodeError, FileNotFoundError) as e:
+        return None
+
+
+def verify_dsse_structure(dsse: dict) -> list[VerificationResult]:
+    """Verify DSSE envelope structure."""
+    results = []
+
+    # Check required fields
+    if "payloadType" not in dsse:
+        results.append(VerificationResult(False, "Missing payloadType"))
+    else:
+        results.append(VerificationResult(True, f"payloadType: {dsse['payloadType']}"))
+
+    if "payload" not in dsse:
+        results.append(VerificationResult(False, "Missing payload"))
+    else:
+        results.append(VerificationResult(True, "payload present"))
+
+    if "signatures" not in dsse or not dsse["signatures"]:
+        results.append(VerificationResult(False, "Missing or empty signatures"))
+    else:
+        sig_count = len(dsse["signatures"])
+        results.append(VerificationResult(True, f"Found {sig_count} signature(s)"))
+
+        # Check for placeholder signatures
+        for i, sig in enumerate(dsse["signatures"]):
+            sig_value = sig.get("sig", "")
+            if sig_value.startswith("PLACEHOLDER"):
+                results.append(VerificationResult(
+                    False,
+                    f"Signature {i} is placeholder",
+                    "Bundle needs actual signing before deployment"
+                ))
+            else:
+                keyid = sig.get("keyid", "unknown")
+                results.append(VerificationResult(True, f"Signature {i} keyid: {keyid}"))
+
+    return results
+
+
+def decode_payload(dsse: dict) -> tuple[dict | None, list[VerificationResult]]:
+    """Decode DSSE payload."""
+    results = []
+
+    payload_b64 = dsse.get("payload", "")
+    if not payload_b64:
+        results.append(VerificationResult(False, "Empty payload"))
+        return None, results
+
+    try:
+        payload_bytes = base64.b64decode(payload_b64)
+        payload = json.loads(payload_bytes)
+        results.append(VerificationResult(True, "Payload decoded successfully"))
+        return payload, results
+    except Exception as e:
+        results.append(VerificationResult(False, f"Failed to decode payload: {e}"))
+        return None, results
+
+
+def verify_openvex(payload: dict) -> list[VerificationResult]:
+    """Verify OpenVEX document structure."""
+    results = []
+
+    # Check OpenVEX context
+    context = payload.get("@context", "")
+    if "openvex" in context.lower():
+        results.append(VerificationResult(True, f"OpenVEX context: {context}"))
+    else:
+        results.append(VerificationResult(False, f"Unexpected context: {context}"))
+
+    # Check statements
+    statements = payload.get("statements", [])
+    if not statements:
+        results.append(VerificationResult(False, "No VEX statements"))
+    else:
+        results.append(VerificationResult(True, f"Contains {len(statements)} statement(s)"))
+
+        for i, stmt in enumerate(statements):
+            vuln = stmt.get("vulnerability", {})
+            vuln_id = vuln.get("name", vuln.get("@id", "unknown"))
+            status = stmt.get("status", "unknown")
+            results.append(VerificationResult(
+                True,
+                f"Statement {i}: {vuln_id} -> {status}"
+            ))
+
+    return results
+
+
+def verify_evidence_hashes(payload: dict, cas_root: Path | None) -> list[VerificationResult]:
+    """Verify evidence hash references against CAS."""
+    results = []
+
+    statements = payload.get("statements", [])
+    for stmt in statements:
+        impact = stmt.get("impact_statement", "")
+        if "Evidence hash:" in impact:
+            hash_value = impact.split("Evidence hash:")[1].strip()
+            results.append(VerificationResult(True, f"Evidence hash: {hash_value[:16]}..."))
+
+            # Verify against CAS if root provided
+            if cas_root and cas_root.exists():
+                # Look for reachability.json in CAS
+                reach_file = cas_root / "reachability.json"
+                if reach_file.exists():
+                    with open(reach_file, 'rb') as f:
+                        content = f.read()
+                    actual_hash = blake3_hex(content)
+
+                    if actual_hash == hash_value or hash_value in actual_hash:
+                        results.append(VerificationResult(True, "Evidence hash matches CAS"))
+                    else:
+                        results.append(VerificationResult(
+                            False,
+                            "Evidence hash mismatch",
+                            f"Expected: {hash_value[:32]}..., Got: {actual_hash[:32]}..."
+                        ))
+
+    return results
+
+
+def verify_catalog_membership(payload: dict, catalog_path: Path) -> list[VerificationResult]:
+    """Verify justification is in catalog."""
+    results = []
+
+    if not catalog_path.exists():
+        results.append(VerificationResult(False, f"Catalog not found: {catalog_path}"))
+        return results
+
+    catalog = load_json(catalog_path)
+    if catalog is None:
+        results.append(VerificationResult(False, "Failed to load catalog"))
+        return results
+
+    # Extract catalog entries
+    entries = catalog if isinstance(catalog, list) else catalog.get("entries", [])
+    catalog_ids = {e.get("id", "") for e in entries}
+
+    # Check each statement's justification
+    statements = payload.get("statements", [])
+    for stmt in statements:
+        justification = stmt.get("justification")
+        if justification:
+            if justification in catalog_ids:
+                results.append(VerificationResult(
+                    True,
+                    f"Justification '{justification}' in catalog"
+                ))
+            else:
+                results.append(VerificationResult(
+                    False,
+                    f"Justification '{justification}' not in catalog"
+                ))
+
+    return results
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Offline VEX proof bundle verifier"
+    )
+    parser.add_argument(
+        "--bundle",
+        type=Path,
+        required=True,
+        help="Path to DSSE bundle file"
+    )
+    parser.add_argument(
+        "--cas-root",
+        type=Path,
+        default=None,
+        help="Path to CAS evidence directory"
+    )
+    parser.add_argument(
+        "--catalog",
+        type=Path,
+        default=Path("docs/benchmarks/vex-justifications.catalog.json"),
+        help="Path to justification catalog"
+    )
+
+    args = parser.parse_args()
+
+    # Resolve paths
+    repo_root = Path(__file__).parent.parent.parent
+    bundle_path = args.bundle if args.bundle.is_absolute() else repo_root / args.bundle
+    catalog_path = args.catalog if args.catalog.is_absolute() else repo_root / args.catalog
+    cas_root = args.cas_root if args.cas_root and args.cas_root.is_absolute() else (
+        repo_root / args.cas_root if args.cas_root else None
+    )
+
+    print(f"Verifying: {bundle_path}")
+    print("")
+
+    all_results = []
+    passed = 0
+    failed = 0
+
+    # Load DSSE bundle
+    dsse = load_json(bundle_path)
+    if dsse is None:
+        print("\033[0;31m✗\033[0m Failed to load bundle")
+        return 1
+
+    # Verify DSSE structure
+    print("DSSE Structure:")
+    results = verify_dsse_structure(dsse)
+    for r in results:
+        print(f"  {r}")
+        if r.passed:
+            passed += 1
+        else:
+            failed += 1
+    all_results.extend(results)
+
+    # Decode payload
+    print("\nPayload:")
+    payload, results = decode_payload(dsse)
+    for r in results:
+        print(f"  {r}")
+        if r.passed:
+            passed += 1
+        else:
+            failed += 1
+    all_results.extend(results)
+
+    if payload:
+        # Verify OpenVEX structure
+        payload_type = dsse.get("payloadType", "")
+        if "openvex" in payload_type.lower():
+            print("\nOpenVEX:")
+            results = verify_openvex(payload)
+            for r in results:
+                print(f"  {r}")
+                if r.passed:
+                    passed += 1
+                else:
+                    failed += 1
+            all_results.extend(results)
+
+        # Verify evidence hashes
+        print("\nEvidence:")
+        results = verify_evidence_hashes(payload, cas_root)
+        for r in results:
+            print(f"  {r}")
+            if r.passed:
+                passed += 1
+            else:
+                failed += 1
+        all_results.extend(results)
+
+        # Verify catalog membership
+        print("\nCatalog:")
+        results = verify_catalog_membership(payload, catalog_path)
+        for r in results:
+            print(f"  {r}")
+            if r.passed:
+                passed += 1
+            else:
+                failed += 1
+        all_results.extend(results)
+
+    # Summary
+    print(f"\n{'='*40}")
+    print(f"Passed: {passed}, Failed: {failed}")
+
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
--- a/bench/tools/verify.sh
+++ b/bench/tools/verify.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# BENCH-AUTO-401-019: Online DSSE + Rekor verification script
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_pass() { echo -e "${GREEN}✓${NC} $*"; }
+log_fail() { echo -e "${RED}✗${NC} $*"; }
+log_warn() { echo -e "${YELLOW}!${NC} $*"; }
+
+usage() {
+    echo "Usage: $0 <dsse-file> [--catalog PATH] [--rekor-url URL]"
+    echo ""
+    echo "Verify a VEX proof bundle with DSSE signature and Rekor inclusion."
+    echo ""
+    echo "Options:"
+    echo "  --catalog PATH    Path to justification catalog (default: docs/benchmarks/vex-justifications.catalog.json)"
+    echo "  --rekor-url URL   Rekor URL (default: https://rekor.sigstore.dev)"
+    echo "  --offline         Skip Rekor verification"
+    echo "  --help, -h        Show this help"
+    exit 1
+}
+
+DSSE_FILE=""
+CATALOG="${REPO_ROOT}/docs/benchmarks/vex-justifications.catalog.json"
+REKOR_URL="https://rekor.sigstore.dev"
+OFFLINE=false
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --catalog)
+            CATALOG="$2"
+            shift 2
+            ;;
+        --rekor-url)
+            REKOR_URL="$2"
+            shift 2
+            ;;
+        --offline)
+            OFFLINE=true
+            shift
+            ;;
+        --help|-h)
+            usage
+            ;;
+        *)
+            if [[ -z "$DSSE_FILE" ]]; then
+                DSSE_FILE="$1"
+            else
+                echo "Unknown option: $1"
+                usage
+            fi
+            shift
+            ;;
+    esac
+done
+
+if [[ -z "$DSSE_FILE" ]]; then
+    echo "Error: DSSE file required"
+    usage
+fi
+
+if [[ ! -f "$DSSE_FILE" ]]; then
+    echo "Error: DSSE file not found: $DSSE_FILE"
+    exit 1
+fi
+
+echo "Verifying: $DSSE_FILE"
+echo ""
+
+# Step 1: Validate JSON structure
+if ! python3 -c "import json; json.load(open('$DSSE_FILE'))" 2>/dev/null; then
+    log_fail "Invalid JSON"
+    exit 1
+fi
+log_pass "Valid JSON structure"
+
+# Step 2: Check DSSE envelope structure
+PAYLOAD_TYPE=$(python3 -c "import json; print(json.load(open('$DSSE_FILE')).get('payloadType', ''))")
+if [[ -z "$PAYLOAD_TYPE" ]]; then
+    log_fail "Missing payloadType"
+    exit 1
+fi
+log_pass "DSSE payloadType: $PAYLOAD_TYPE"
+
+# Step 3: Decode and validate payload
+PAYLOAD_B64=$(python3 -c "import json; print(json.load(open('$DSSE_FILE')).get('payload', ''))")
+if [[ -z "$PAYLOAD_B64" ]]; then
+    log_fail "Missing payload"
+    exit 1
+fi
+
+# Decode payload
+PAYLOAD_JSON=$(echo "$PAYLOAD_B64" | base64 -d 2>/dev/null || echo "")
+if [[ -z "$PAYLOAD_JSON" ]]; then
+    log_fail "Failed to decode payload"
+    exit 1
+fi
+log_pass "Payload decoded successfully"
+
+# Step 4: Validate OpenVEX structure (if applicable)
+if [[ "$PAYLOAD_TYPE" == *"openvex"* ]]; then
+    STATEMENTS_COUNT=$(echo "$PAYLOAD_JSON" | python3 -c "import json,sys; d=json.load(sys.stdin); print(len(d.get('statements', [])))")
+    if [[ "$STATEMENTS_COUNT" -eq 0 ]]; then
+        log_warn "OpenVEX has no statements"
+    else
+        log_pass "OpenVEX contains $STATEMENTS_COUNT statement(s)"
+    fi
+fi
+
+# Step 5: Check signature presence
+SIG_COUNT=$(python3 -c "import json; print(len(json.load(open('$DSSE_FILE')).get('signatures', [])))")
+if [[ "$SIG_COUNT" -eq 0 ]]; then
+    log_fail "No signatures found"
+    exit 1
+fi
+log_pass "Found $SIG_COUNT signature(s)"
+
+# Step 6: Check for placeholder signatures
+SIG_VALUE=$(python3 -c "import json; sigs=json.load(open('$DSSE_FILE')).get('signatures', []); print(sigs[0].get('sig', '') if sigs else '')")
+if [[ "$SIG_VALUE" == "PLACEHOLDER"* ]]; then
+    log_warn "Signature is a placeholder (not yet signed)"
+else
+    log_pass "Signature present (verification requires public key)"
+fi
+
+# Step 7: Rekor verification (if online)
+if [[ "$OFFLINE" == false ]]; then
+    # Check for rekor.txt in same directory
+    DSSE_DIR=$(dirname "$DSSE_FILE")
+    REKOR_FILE="${DSSE_DIR}/rekor.txt"
+
+    if [[ -f "$REKOR_FILE" ]]; then
+        LOG_INDEX=$(grep -E "^log_index:" "$REKOR_FILE" | cut -d: -f2 | tr -d ' ')
+        if [[ "$LOG_INDEX" != "PENDING" && -n "$LOG_INDEX" ]]; then
+            log_pass "Rekor log index: $LOG_INDEX"
+
+            # Verify with Rekor API
+            if command -v curl &>/dev/null; then
+                REKOR_RESP=$(curl -s "${REKOR_URL}/api/v1/log/entries?logIndex=${LOG_INDEX}" 2>/dev/null || echo "")
+                if [[ -n "$REKOR_RESP" && "$REKOR_RESP" != "null" ]]; then
+                    log_pass "Rekor inclusion verified"
+                else
+                    log_warn "Could not verify Rekor inclusion (may be offline or index invalid)"
+                fi
+            else
+                log_warn "curl not available for Rekor verification"
+            fi
+        else
+            log_warn "Rekor entry pending submission"
+        fi
+    else
+        log_warn "No rekor.txt found - Rekor verification skipped"
+    fi
+else
+    log_warn "Offline mode - Rekor verification skipped"
+fi
+
+# Step 8: Check justification catalog membership
+if [[ -f "$CATALOG" ]]; then
+    # Extract justification from payload if present
+    JUSTIFICATION=$(echo "$PAYLOAD_JSON" | python3 -c "
+import json, sys
+d = json.load(sys.stdin)
+stmts = d.get('statements', [])
+if stmts:
+    print(stmts[0].get('justification', ''))
+" 2>/dev/null || echo "")
+
+    if [[ -n "$JUSTIFICATION" ]]; then
+        CATALOG_MATCH=$(python3 -c "
+import json
+catalog = json.load(open('$CATALOG'))
+entries = catalog if isinstance(catalog, list) else catalog.get('entries', [])
+ids = [e.get('id', '') for e in entries]
+print('yes' if '$JUSTIFICATION' in ids else 'no')
+" 2>/dev/null || echo "no")
+
+        if [[ "$CATALOG_MATCH" == "yes" ]]; then
+            log_pass "Justification '$JUSTIFICATION' found in catalog"
+        else
+            log_warn "Justification '$JUSTIFICATION' not in catalog"
+        fi
+    fi
+else
+    log_warn "Justification catalog not found at $CATALOG"
+fi
+
+echo ""
+echo "Verification complete."