Add receipt input JSON and SHA256 hash for CVSS policy scoring tests

- Introduced a new JSON fixture `receipt-input.json` containing base, environmental, and threat metrics for CVSS scoring.
- Added corresponding SHA256 hash file `receipt-input.sha256` to ensure integrity of the JSON fixture.

bench/reachability-benchmark/cases/c/guarded-system/case.yaml

@@ -18,13 +18,18 @@ environment:
   runtime:
     gcc: "13"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
   outputs:
     artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
-    traces_path: outputs/traces/traces.json
+    traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -35,3 +40,9 @@ ground_truth:
   summary: "Without ALLOW_CMD, the system() sink remains unreachable; with ALLOW_CMD=1, it executes."
   evidence_files:
     - "../../../benchmark/truth/c-guarded-system.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/c/guarded-system/entrypoints.yaml

@@ -0,0 +1,7 @@
+case_id: "c-guarded-system:001"
+entries:
+  cli:
+    - id: "main"
+      command: "./app"
+      args: ["<user_input>"]
+      description: "system() guarded by ALLOW_CMD flag"

bench/reachability-benchmark/cases/c/guarded-system/outputs/sbom.cdx.json

@@ -0,0 +1,14 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [],
+  "metadata": {
+    "component": {
+      "name": "guarded-system",
+      "type": "application",
+      "version": "1.0.0"
+    },
+    "timestamp": "1970-01-01T00:00:00Z"
+  },
+  "specVersion": "1.5",
+  "version": 1
+}

bench/reachability-benchmark/cases/c/memcpy-overflow/case.yaml

@@ -18,13 +18,18 @@ environment:
   runtime:
     gcc: "13"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
   outputs:
     artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
-    traces_path: outputs/traces/traces.json
+    traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -35,3 +40,9 @@ ground_truth:
   summary: "Calling process_buffer with len>256 drives memcpy with attacker length (reachable)."
   evidence_files:
     - "../../../benchmark/truth/c-memcpy-overflow.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/c/memcpy-overflow/entrypoints.yaml

@@ -0,0 +1,7 @@
+case_id: "c-memcpy-overflow:001"
+entries:
+  cli:
+    - id: "process_buffer"
+      command: "./app"
+      args: ["<length>"]
+      description: "User length forwarded to memcpy without bounds"

bench/reachability-benchmark/cases/c/memcpy-overflow/outputs/sbom.cdx.json

@@ -0,0 +1,14 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [],
+  "metadata": {
+    "component": {
+      "name": "memcpy-overflow",
+      "type": "application",
+      "version": "1.0.0"
+    },
+    "timestamp": "1970-01-01T00:00:00Z"
+  },
+  "specVersion": "1.5",
+  "version": 1
+}

bench/reachability-benchmark/cases/c/unsafe-system/case.yaml

@@ -18,13 +18,18 @@ environment:
   runtime:
     gcc: "13"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
   outputs:
     artifact_path: outputs/binary.tar.gz
+    sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
-    traces_path: outputs/traces/traces.json
+    traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -35,3 +40,9 @@ ground_truth:
   summary: "Running with argument 'echo OK' executes system() with user-controlled payload."
   evidence_files:
     - "../../../benchmark/truth/c-unsafe-system.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/c/unsafe-system/entrypoints.yaml

@@ -0,0 +1,7 @@
+case_id: "c-unsafe-system:001"
+entries:
+  cli:
+    - id: "main"
+      command: "./app"
+      args: ["<user_input>"]
+      description: "Passes argv directly into system()"

bench/reachability-benchmark/cases/c/unsafe-system/outputs/sbom.cdx.json

@@ -0,0 +1,14 @@
+{
+  "bomFormat": "CycloneDX",
+  "components": [],
+  "metadata": {
+    "component": {
+      "name": "unsafe-system",
+      "type": "application",
+      "version": "1.0.0"
+    },
+    "timestamp": "1970-01-01T00:00:00Z"
+  },
+  "specVersion": "1.5",
+  "version": 1
+}

bench/reachability-benchmark/cases/java/spring-deserialize/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     java: "21"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./build/build.sh"
   expected_coverage: []
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Deserialization reachable"
   evidence_files:
     - "../benchmark/truth/java-spring-deserialize.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/java/spring-guarded/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     java: "21"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./build/build.sh"
   expected_coverage: []
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Guard blocks deserialization unless ALLOW_DESER=true"
   evidence_files:
     - "../benchmark/truth/java-spring-guarded.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/js/express-eval/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     node: "20.11.0"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Admin exec endpoint reachable and executes eval"
   evidence_files:
     - "../benchmark/truth/js-express-eval.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/js/express-guarded/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     node: "20.11.0"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Guard prevents sink unless ALLOW_EXEC=true"
   evidence_files:
     - "../benchmark/truth/js-express-guarded.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/js/fastify-template/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     node: "20.11.0"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Template rendering reachable via POST /api/render"
   evidence_files:
     - "../benchmark/truth/js-fastify-template.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/js/guarded-eval/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     node: "20.11.0"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Guard prevents sink when FEATURE_ENABLE != 1"
   evidence_files:
     - "../benchmark/truth/js-guarded-eval.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/js/unsafe-eval/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     node: "20.11.0"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Unit test triggers eval sink with payload {code: '1+2'}"
   evidence_files:
     - "../benchmark/truth/js-unsafe-eval.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/py/django-ssti/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     python: "3.12"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Template rendering reachable with autoescape off"
   evidence_files:
     - "../benchmark/truth/py-django-ssti.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/py/fastapi-guarded/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     python: "3.12"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Guard blocks eval unless ALLOW_EXEC=true"
   evidence_files:
     - "../benchmark/truth/py-fastapi-guarded.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/py/flask-template/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     python: "3.12"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Template rendering reachable"
   evidence_files:
     - "../benchmark/truth/py-flask-template.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/py/guarded-exec/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     python: "3.12"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Guard blocks eval when FEATURE_ENABLE != 1"
   evidence_files:
     - "../benchmark/truth/py-guarded-exec.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"

bench/reachability-benchmark/cases/py/unsafe-exec/case.yaml

@@ -18,6 +18,9 @@ environment:
   runtime:
     python: "3.12"
   source_date_epoch: 1730000000
+  resource_limits:
+    cpu: "2"
+    memory: "4Gi"
 build:
   command: "./build/build.sh"
   source_date_epoch: 1730000000
@@ -26,6 +29,7 @@ build:
     sbom_path: outputs/sbom.cdx.json
     coverage_path: outputs/coverage.json
     traces_dir: outputs/traces
+    attestation_path: outputs/attestation.json
 test:
   command: "./tests/run-tests.sh"
   expected_coverage:
@@ -36,3 +40,9 @@ ground_truth:
   summary: "Eval reachable via POST /api/exec"
   evidence_files:
     - "../benchmark/truth/py-unsafe-exec.json"
+sandbox:
+  network: loopback
+  privileges: rootless
+redaction:
+  pii: false
+  policy: "benchmark-default/v1"