# Reachability Corpus (QA-CORPUS-401-031)

Layout
- `manifest.json` — deterministic SHA-256 hashes for each case file.
- `<language>/<case>/ground-truth.json` — expected reachability outcome (`reachable|unreachable`) and example path(s) (Reachbench truth schema v1).
- `<language>/<case>/callgraph.static.json` — static call graph sample (stub for MVP).
- `<language>/<case>/vex.openvex.json` — expected VEX slice for the case.
- Legacy `expect.yaml` has been retired; its state/score are preserved under `legacy_expect` in `ground-truth.json`.

Determinism
- JSON files have sorted keys; hashes recorded in `manifest.json`.
- Scores rounded to 2dp; timestamps (if added later) must be UTC ISO-8601.
- No network access required to consume the corpus.

MVP cases (stubs, to be replaced with real artifacts)
- Go: `go-ssh-CVE-2020-9283-keyexchange`
- .NET: `dotnet-kestrel-CVE-2023-44487-http2-rapid-reset`
- Python: `python-django-CVE-2019-19844-sqli-like`
- Rust: `rust-axum-header-parsing-TBD`

CI intent
- `CorpusFixtureTests` validates presence and hashes from the manifest; hook this into CI once repo build stabilises.