up

docs/reachability/evidence-schema.md

@@ -18,6 +18,7 @@ Purpose: define the canonical fields for reachability graph nodes/edges, runtime
       "id": "sym:sha256:...",
       "symbol_id": "func:ELF:sha256:...",
       "code_id": "code:ELF:sha256:...",
+      "code_block_hash": "sha256:deadbeef...",
       "purl": "pkg:deb/ubuntu/openssl@3.0.2?arch=amd64",
       "symbol": { "mangled": "_Z15ssl3_read_bytes", "demangled": "ssl3_read_bytes", "source": "DWARF", "confidence": 0.98 },
       "build_id": "a1b2c3...",
@@ -88,6 +89,7 @@ Metadata for each CAS object: `{ schema: "richgraph-v1", analyzer: {name,version
 - All edges must carry either `purl` or `candidates[]`; never leave both empty.
 - If `build_id` present, `symbol_id` and `code_id` must store it; if absent, record `build_id_source: "FileHash"`.
 - Evidence arrays sorted; confidence in [0,1].
+- `code_block_hash` (when present) must be lowercase hex with an algorithm prefix (e.g., `sha256:`) and only accompany stripped/heuristic nodes.
 - Roots must include load-time constructors when present.
 - When `edge_bundles` are present, each edge in a bundle must also exist in the graph edge set; `revoked=true` bundles override graph edges for policy/scoring.
 - Graph DSSE is mandatory per scan; edge-bundle DSSEs are optional but must reference `graph_hash` and `bundle_id`.

docs/reachability/function-level-evidence.md

@@ -44,6 +44,7 @@ Out of scope: implementing disassemblers or symbol servers; those will be handle
 * Deliver fixtures in `tests/reachability/StellaOps.ScannerSignals.IntegrationTests` that prove determinism (same hash when analyzer flags reorder).
 * **Helper status (2025-12-02):** `SymbolId.ForBinaryAddressed` + `CodeId.ForBinarySegment` now encode `{file_hash, section, addr, name, linkage, length, code_block_hash}` with normalized hex addresses. Analyzers should start emitting these tuples instead of ad-hoc hashes.
 * **Binary lifter (2025-12-03):** `BinaryReachabilityLifter` emits richgraph nodes for ELF/PE/Mach-O using file SHA-256 + section/address tuples, attaches `code_id` anchors, and turns imports/load commands into `import` edges.
+* **Schema wiring (2025-12-12):** `reachability-union` + `richgraph-v1` serializers now emit `symbol {mangled,demangled,source,confidence}` and optional `code_block_hash` for stripped blocks; confidence is clamped to `[0,1]` and `source` normalized to uppercase (`DWARF|PDB|SYM|NONE`).
 
 ### 3.2 Runtime + Signals (GAP-ZAS-002 / GAP-SIG-003)