Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/__Libraries/StellaOps.Replay.Core/ReplayManifest.cs

@@ -0,0 +1,69 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+namespace StellaOps.Replay.Core;
+
+public sealed class ReplayManifest
+{
+    [JsonPropertyName("schemaVersion")]
+    public string SchemaVersion { get; set; } = "1.0";
+
+    [JsonPropertyName("scan")]
+    public ReplayScanMetadata Scan { get; set; } = new();
+
+    [JsonPropertyName("reachability")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    public ReplayReachabilitySection? Reachability { get; set; }
+}
+
+public sealed class ReplayScanMetadata
+{
+    [JsonPropertyName("id")]
+    public string Id { get; set; } = string.Empty;
+
+    [JsonPropertyName("time")]
+    public DateTimeOffset Time { get; set; } = DateTimeOffset.UtcNow;
+}
+
+public sealed class ReplayReachabilitySection
+{
+    [JsonPropertyName("graphs")]
+    public List<ReplayReachabilityGraphReference> Graphs { get; set; } = new();
+
+    [JsonPropertyName("runtimeTraces")]
+    public List<ReplayReachabilityTraceReference> RuntimeTraces { get; set; } = new();
+}
+
+public sealed class ReplayReachabilityGraphReference
+{
+    [JsonPropertyName("kind")]
+    public string Kind { get; set; } = "static";
+
+    [JsonPropertyName("casUri")]
+    public string CasUri { get; set; } = string.Empty;
+
+    [JsonPropertyName("sha256")]
+    public string Sha256 { get; set; } = string.Empty;
+
+    [JsonPropertyName("analyzer")]
+    public string Analyzer { get; set; } = string.Empty;
+
+    [JsonPropertyName("version")]
+    public string Version { get; set; } = string.Empty;
+}
+
+public sealed class ReplayReachabilityTraceReference
+{
+    [JsonPropertyName("source")]
+    public string Source { get; set; } = string.Empty;
+
+    [JsonPropertyName("casUri")]
+    public string CasUri { get; set; } = string.Empty;
+
+    [JsonPropertyName("sha256")]
+    public string Sha256 { get; set; } = string.Empty;
+
+    [JsonPropertyName("recordedAt")]
+    public DateTimeOffset RecordedAt { get; set; } = DateTimeOffset.UtcNow;
+}

src/__Libraries/StellaOps.Replay.Core/ReplayManifestExtensions.cs

@@ -0,0 +1,22 @@
+using System;
+
+namespace StellaOps.Replay.Core;
+
+public static class ReplayManifestExtensions
+{
+    public static void AddReachabilityGraph(this ReplayManifest manifest, ReplayReachabilityGraphReference graph)
+    {
+        ArgumentNullException.ThrowIfNull(manifest);
+        ArgumentNullException.ThrowIfNull(graph);
+        manifest.Reachability ??= new ReplayReachabilitySection();
+        manifest.Reachability.Graphs.Add(graph);
+    }
+
+    public static void AddReachabilityTrace(this ReplayManifest manifest, ReplayReachabilityTraceReference trace)
+    {
+        ArgumentNullException.ThrowIfNull(manifest);
+        ArgumentNullException.ThrowIfNull(trace);
+        manifest.Reachability ??= new ReplayReachabilitySection();
+        manifest.Reachability.RuntimeTraces.Add(trace);
+    }
+}

src/__Libraries/StellaOps.Replay.Core/StellaOps.Replay.Core.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="System.Text.Json" Version="10.0.0-preview.7.25380.108" />
+  </ItemGroup>
+</Project>

src/__Libraries/StellaOps.Replay.Core/TASKS.md

@@ -4,3 +4,4 @@
 |----|--------|-------------|--------------|---------------|
 | REPLAY-CORE-185-001 | TODO | Scaffold replay core library (`StellaOps.Replay.Core`) with manifest schema types, canonical JSON utilities, Merkle helpers, DSSE payload builders, and module charter updates referencing `docs/replay/DETERMINISTIC_REPLAY.md`. | Sprint 185 replay planning | Library builds/tests succeed; AGENTS.md updated; integration notes cross-linked. |
 | REPLAY-CORE-185-002 | TODO | Implement deterministic bundle writer (tar.zst, CAS naming) and hashing abstractions; extend `docs/modules/platform/architecture-overview.md` with “Replay CAS” section. | REPLAY-CORE-185-001 | Bundle writer unit tests pass; documentation merged with examples; CAS layout reproducible. |
+| REPLAY-REACH-201-005 | DOING (2025-11-08) | Extend manifest schema + bundle writer to include reachability graphs, runtime traces, analyzer versions, and CAS URIs; update docs + serializers per `SPRINT_201_reachability_explainability`. | REPLAY-CORE-185-001, SIGNALS-REACH-201-003 | Manifest schema merged; unit tests cover new sections; docs + CAS layout references updated. |