new advisories

docs/reachability/corpus-plan.md

@@ -3,6 +3,7 @@
 Objective
 - Build a multi-runtime reachability corpus (Go/.NET/Python/Rust) with EXPECT.yaml ground truths and captured traces.
 - Make fixtures CI-consumable to validate reachability scoring and VEX proofs continuously.
+- Add public mini-dataset cases (PHP/JavaScript/C#) from advisory 23-Nov-2025 for ingestion/bench reuse.
 
 Scope & deliverables
 - Fixture layout: `tests/reachability/corpus/<language>/<case>/`
@@ -13,6 +14,17 @@ Scope & deliverables
   - `vex.openvex.json` — expected VEX statement.
 - CI integration: add corpus harness to `tests/reachability/StellaOps.Reachability.FixtureTests` to validate presence, schema, and determinism (hash manifest).
 - Offline posture: all artifacts deterministic, no external downloads; hashes recorded in manifest.
+- Public mini-dataset layout (PHP/JS/C#) to be mirrored under `tests/reachability/samples-public/`:
+```
+vuln-reach-dataset/
+  schema/ground-truth.schema.json
+  runners/run_all.sh
+  samples/
+    php/php-001-phar-deserialize/...
+    js/js-002-yaml-unsafe-load/...
+    csharp/cs-001-binaryformatter-deserialize/...
+```
+Each sample ships: minimal app, lockfile, SBOM (CycloneDX JSON), VEX, ground truth (EXPECT/JSON), repro script.
 
 MVP slice (proposed)
 - Go: `go-ssh-CVE-2020-9283-keyexchange`