6e45066e37
Some checks failed
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Signals CI & Image / signals-ci (push) Has been cancelled
Signals Reachability Scoring & Events / reachability-smoke (push) Has been cancelled
Signals Reachability Scoring & Events / sign-and-upload (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Scanner Analyzers / Discover Analyzers (push) Has been cancelled
Scanner Analyzers / Build Analyzers (push) Has been cancelled
Scanner Analyzers / Test Language Analyzers (push) Has been cancelled
Scanner Analyzers / Validate Test Fixtures (push) Has been cancelled
Scanner Analyzers / Verify Deterministic Output (push) Has been cancelled
Reachability Corpus (QA-CORPUS-401-031)
Layout
manifest.json— deterministic SHA-256 hashes for each case file.<language>/<case>/ground-truth.json— expected reachability outcome (reachable|unreachable) and example path(s) (Reachbench truth schema v1).<language>/<case>/callgraph.static.json— static call graph sample (stub for MVP).<language>/<case>/vex.openvex.json— expected VEX slice for the case.- Legacy
expect.yamlhas been retired; its state/score are preserved underlegacy_expectinground-truth.json.
Determinism
- JSON files have sorted keys; hashes recorded in
manifest.json. - Scores rounded to 2dp; timestamps (if added later) must be UTC ISO-8601.
- No network access required to consume the corpus.
MVP cases (stubs, to be replaced with real artifacts)
- Go:
go-ssh-CVE-2020-9283-keyexchange - .NET:
dotnet-kestrel-CVE-2023-44487-http2-rapid-reset - Python:
python-django-CVE-2019-19844-sqli-like - Rust:
rust-axum-header-parsing-TBD
CI intent
CorpusFixtureTestsvalidates presence and hashes from the manifest; hook this into CI once repo build stabilises.