new advisories

docs/reachability/evidence-schema.md

@@ -46,6 +46,16 @@ Purpose: define the canonical fields for reachability graph nodes/edges, runtime
 }
 ```
 
+## 2.5 Attestation levels (hybrid default)
+
+- **Graph DSSE (required):** one DSSE envelope over the canonical graph JSON (sorted arrays/keys) with `graph_hash` = BLAKE3 of body; Rekor publish always (or mirror when offline).
+- **Edge-bundle DSSE (optional):** batches of ≤512 edges, emitted only for high-signal cases (`runtime`, `init_array`/TLS roots, contested/third-party edges). Each bundle carries `graph_hash`, `bundle_reason`, per-edge `reason`, `symbol_digest`, `purl`, `confidence`, and optional `revoked=true` for quarantine. Rekor publish is configurable; CAS storage is mandatory.
+- CAS layout additions:
+  - Graph body: `cas://reachability/graphs/{blake3}`
+  - Graph DSSE: `cas://reachability/graphs/{blake3}.dsse`
+  - Edge bundle: `cas://reachability/edges/{graph_hash}/{bundle_id}` + `.dsse`
+- Determinism: bundle ordering by `(bundle_reason, edge_id)`; arrays sorted before hashing.
+
 ## 3. Runtime facts (Signals ingestion)
 
 Fields per NDJSON event:
@@ -69,6 +79,7 @@ Unknowns must include `unknown_type`, `scope`, `provenance`, `confidence.p`, and
 - Graphs: `cas://reachability/graphs/{blake3}` (canonical JSON, sorted keys/arrays)
 - Runtime traces: `cas://reachability/runtime/{sha256}`
 - Unknowns evidence (optional large blobs): `cas://unknowns/{sha256}`
+- Edge bundles: `cas://reachability/edges/{graph_hash}/{bundle_id}` (JSON + `.dsse`)
 
 Metadata for each CAS object: `{ schema: "richgraph-v1", analyzer: {name,version}, createdAtUtc, toolchain_digest }`. When analyzer metadata is supplied at ingest (Signals OpenAPI), persist it alongside parsed analyzer fields from the artifact.
 
@@ -78,6 +89,8 @@ Metadata for each CAS object: `{ schema: "richgraph-v1", analyzer: {name,version
 - If `build_id` present, `symbol_id` and `code_id` must store it; if absent, record `build_id_source: "FileHash"`.
 - Evidence arrays sorted; confidence in [0,1].
 - Roots must include load-time constructors when present.
+- When `edge_bundles` are present, each edge in a bundle must also exist in the graph edge set; `revoked=true` bundles override graph edges for policy/scoring.
+- Graph DSSE is mandatory per scan; edge-bundle DSSEs are optional but must reference `graph_hash` and `bundle_id`.
 
 ## 7. Acceptance checklist