git.stella-ops.org/tests/reachability/corpus

Reachability Corpus (QA-CORPUS-401-031)

Layout

• manifest.json — deterministic SHA-256 hashes for each case file.
• <language>/<case>/expect.yaml — state (reachable|conditional|unreachable), score, evidence refs.
• <language>/<case>/callgraph.static.json — static call graph sample (stub for MVP).
• <language>/<case>/vex.openvex.json — expected VEX slice for the case.

Determinism

• JSON files have sorted keys; hashes recorded in manifest.json.
• Scores rounded to 2dp; timestamps (if added later) must be UTC ISO-8601.
• No network access required to consume the corpus.

MVP cases (stubs, to be replaced with real artifacts)

• Go: go-ssh-CVE-2020-9283-keyexchange
• .NET: dotnet-kestrel-CVE-2023-44487-http2-rapid-reset
• Python: python-django-CVE-2019-19844-sqli-like
• Rust: rust-axum-header-parsing-TBD

CI intent

• CorpusFixtureTests validates presence and hashes from the manifest; hook this into CI once repo build stabilises.