save checkpoint

2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
--- a/docs/qa/feature-checks/state/reachgraph.json
+++ b/docs/qa/feature-checks/state/reachgraph.json
@@ -0,0 +1,97 @@
+{
+  "module": "reachgraph",
+  "featureCount": 9,
+  "lastUpdatedUtc": "2026-02-13T12:00:00Z",
+  "summary": {
+    "passed": 9,
+    "failed": 0,
+    "blocked": 0,
+    "skipped": 0,
+    "done": 9,
+    "queued": 0
+  },
+  "buildNote": "All 9 features verified. Two test projects: StellaOps.ReachGraph.WebService.Tests (26 passed) and StellaOps.Reachability.Core.Tests (224 passed). Total 250 tests, 0 failures. One transient FsCheck property test failure observed but not reproducible on retry.",
+  "features": {
+    "8-state-reachability-lattice": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj",
+      "testsRun": 224,
+      "testsPassed": 224,
+      "testsFailed": 0,
+      "notes": "Full 8-state lattice model implemented: LatticeState enum, ReachabilityLattice state machine with FrozenDictionary transitions, ConfidenceCalculator with weighted scoring, confidence ranges per state."
+    },
+    "cve-to-symbol-mapping-service": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj",
+      "testsRun": 224,
+      "testsPassed": 224,
+      "testsFailed": 0,
+      "notes": "Full CVE-symbol mapping service with CveMappingController at v1/cve-mappings. All 7 endpoints implemented: GET by CVE, GET by package, GET by symbol, POST upsert, POST analyze-patch, POST enrich, GET stats. Rate limiting and response caching in place."
+    },
+    "reachability-analysis-with-call-graph-evidence": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj",
+      "testsRun": 26,
+      "testsPassed": 26,
+      "testsFailed": 0,
+      "notes": "ReachGraphController with slice queries returning call graph evidence. CVE slice returns CveSliceResponse with Sinks and Paths. Package/entrypoint/file slices supported. ReachabilityPath model includes hops and edges for evidence trace."
+    },
+    "reachability-aware-vulnerability-analysis": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj",
+      "testsRun": 224,
+      "testsPassed": 224,
+      "testsFailed": 0,
+      "notes": "Multi-layer reachability with IReachabilityIndex facade combining static (Layer 1-3) and runtime analysis. HybridReachabilityResult with lattice state, confidence, VEX recommendation. Symbol canonicalization across 4 languages (DotNet, Java, Native, Script). ReachabilityController exposes unified API at v1/reachability."
+    },
+    "reachability-core-library-with-unified-query-interface": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj",
+      "testsRun": 26,
+      "testsPassed": 26,
+      "testsFailed": 0,
+      "notes": "IReachabilityIndex unified facade with QueryStaticAsync, QueryRuntimeAsync, QueryHybridAsync, QueryBatchAsync. ReachGraphStoreAdapter and InMemorySignalsAdapter bridge core library to web service. ReachabilityController at v1/reachability exposes all query types."
+    },
+    "reachability-fallback-mechanisms": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj",
+      "testsRun": 26,
+      "testsPassed": 26,
+      "testsFailed": 0,
+      "notes": "ReachGraphStoreService coordinates repository, cache, and signer. Cache-first retrieval with database fallback. Replay verification as determinism fallback. Idempotent upsert. PaginationService for large result sets."
+    },
+    "reachability-replay-verification": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj",
+      "testsRun": 26,
+      "testsPassed": 26,
+      "testsFailed": 0,
+      "notes": "ReachGraphReplayService recomputes digest from stored graph and compares. ReplayRequest/ReplayResponse with InputsVerified and Divergence. POST v1/reachgraphs/replay endpoint. NodeHashRecipe and PathHashRecipe for deterministic hashing."
+    },
+    "reachgraph-slice-query-rest-apis": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/ReachGraph/__Tests/StellaOps.ReachGraph.WebService.Tests/StellaOps.ReachGraph.WebService.Tests.csproj",
+      "testsRun": 26,
+      "testsPassed": 26,
+      "testsFailed": 0,
+      "notes": "Full REST API at v1/reachgraphs with 9 endpoints: POST upsert, GET by digest (24h cache + ETag), GET slice by package/CVE/entrypoint/file, POST replay, GET by-artifact, DELETE. SliceQueryResponse and CveSliceResponse models. Cached slice computation with SHA256 keys."
+    },
+    "static-sbom-call-graph-pruning": {
+      "status": "passed",
+      "tier": "tier2",
+      "testProject": "src/__Libraries/__Tests/StellaOps.Reachability.Core.Tests/StellaOps.Reachability.Core.Tests.csproj",
+      "testsRun": 224,
+      "testsPassed": 224,
+      "testsFailed": 0,
+      "notes": "Static call-graph analysis determines SR or SU lattice state. SymbolCanonicalizer and SymbolMatcher for cross-language matching. ReachGraphStoreAdapter performs BFS traversal for reachability. QueryBatchAsync supports SBOM-wide pruning."
+    }
+  }
+}