Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

docs/replay/DEVS_GUIDE_REPLAY.md

@@ -30,10 +30,11 @@ Replay is the foundation for:
 | **Subject** | OCI image digest, per-layer Merkle roots | ✅ |
 | **Outputs** | SBOM, Findings, VEX, logs (content hashes) | ✅ |
 | **Toolchain** | Sbomer, Scanner, Vexer binaries + versions + SHA256 | ✅ |
-| **Feeds/VEX sources** | Full or pruned snapshot with Merkle proofs | ✅ |
-| **Policy Bundle** | Lattice rules, mutes, trust profiles, thresholds | ✅ |
-| **Environment** | OS, arch, locale, TZ, deterministic seed, runtime flags | ✅ |
-| **Crypto Profile** | Algorithm suites (FIPS, GOST, SM, eIDAS) | ✅ |
+| **Feeds/VEX sources** | Full or pruned snapshot with Merkle proofs | ✅ |
+| **Policy Bundle** | Lattice rules, mutes, trust profiles, thresholds | ✅ |
+| **Environment** | OS, arch, locale, TZ, deterministic seed, runtime flags | ✅ |
+| **Reachability Evidence** | Callgraphs (`graphs[]`), runtime traces (`runtimeTraces[]`), analyzer/version hashes | ✅ |
+| **Crypto Profile** | Algorithm suites (FIPS, GOST, SM, eIDAS) | ✅ |
 
 ---
 
@@ -69,8 +70,9 @@ stella replay manifest.json --what-if --vary=feeds
 
 ## Workflow
 
-1. `stella scan image:tag --record out/`
-   - Generates Replay Manifest, InputBundle, OutputBundle, DSSE sigs.
+1. `stella scan image:tag --record out/`
+   - Generates Replay Manifest, InputBundle, OutputBundle, DSSE sigs.
+   - Captures reachability graphs/traces (if enabled) and references them via `reachability.graphs[]` + `runtimeTraces[]`.
 2. `stella verify manifest.json`
    - Validates hashes, signatures, and completeness.
 3. `stella replay manifest.json --strict`
@@ -82,14 +84,15 @@ stella replay manifest.json --what-if --vary=feeds
 
 ---
 
-## Storage
-
-- **Mongo collections**
-  - `replay_runs`: manifest + DSSE envelopes + status
-  - `bundles`: content-addressed (input/output/rootpack)
-  - `subjects`: OCI digests, Merkle roots per layer
-- **File store**
-  - Bundles stored as `<sha256>.tar.zst`
+## Storage
+
+- **Mongo collections**
+  - `replay_runs`: manifest + DSSE envelopes + status
+  - `bundles`: content-addressed (input/output/rootpack)
+  - `subjects`: OCI digests, Merkle roots per layer
+  - `reachability_facts`: graph & runtime trace references tied to scan subjects
+- **File store**
+  - Bundles stored as `<sha256>.tar.zst`
 
 ---