Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

docs/replay/DETERMINISTIC_REPLAY.md

@@ -98,23 +98,58 @@ C --> J[Blob Store: Input/Output Bundles]
     ],
     "trustProfile": "sha256:..."
   },
-  "outputs": {
-    "sbomHash": "sha256:...",
-    "findingsHash": "sha256:...",
-    "vexHash": "sha256:...",
-    "logHash": "sha256:..."
-  },
-  "provenance": {
-    "signer": "scanner.authority",
-    "dsseEnvelopeHash": "sha256:...",
-    "rekorEntry": "optional"
-  }
-}
-```
-
----
-
-## 4. Deterministic Execution Rules
+  "outputs": {
+    "sbomHash": "sha256:...",
+    "findingsHash": "sha256:...",
+    "vexHash": "sha256:...",
+    "logHash": "sha256:..."
+  },
+  "reachability": {
+    "graphs": [
+      {
+        "kind": "static",
+        "analyzer": "scanner/java@sha256:...",
+        "casUri": "cas://replay/scan-123/reachability/static-graph.tar.zst",
+        "sha256": "abc123"
+      },
+      {
+        "kind": "framework",
+        "analyzer": "scanner/framework@sha256:...",
+        "casUri": "cas://replay/scan-123/reachability/framework-graph.tar.zst",
+        "sha256": "def456"
+      }
+    ],
+    "runtimeTraces": [
+      {
+        "source": "zastava",
+        "casUri": "cas://replay/scan-123/reachability/runtime-trace.ndjson.zst",
+        "sha256": "feedface",
+        "recordedAt": "2025-11-07T11:10:00Z"
+      }
+    ]
+  },
+  "provenance": {
+    "signer": "scanner.authority",
+    "dsseEnvelopeHash": "sha256:...",
+    "rekorEntry": "optional"
+  }
+}
+```
+
+### 3.2 Reachability Section
+
+The optional `reachability` block captures the inputs needed to replay explainability decisions:
+
+| Field | Description |
+|-------|-------------|
+| `reachability.graphs[]` | References to static/framework callgraph bundles. Each entry records the producing analyzer (`analyzer`/`version`), the CAS URI under `cas://replay/<scan-id>/reachability/graphs/`, and the SHA-256 digest of the tarball. |
+| `reachability.runtimeTraces[]` | References to runtime observation bundles (e.g., Zastava ND-JSON traces). Each item stores the emitting source, CAS URI (typically `cas://replay/<scan-id>/reachability/traces/`), SHA-256, and capture timestamp. |
+
+Replay engines MUST verify every referenced artifact hash before re-evaluating reachability. Missing graphs downgrade affected signals to `reachability:unknown` and should raise policy warnings.
+
+---
+
+## 4. Deterministic Execution Rules
 
 ### 4.1 Environment Normalization