Reachability Corpus (QA-CORPUS-401-031)
Layout
manifest.json— deterministic SHA-256 hashes for each case file.<language>/<case>/expect.yaml— state (reachable|conditional|unreachable), score, evidence refs.<language>/<case>/callgraph.static.json— static call graph sample (stub for MVP).<language>/<case>/vex.openvex.json— expected VEX slice for the case.
Determinism
- JSON files have sorted keys; hashes recorded in
manifest.json. - Scores rounded to 2dp; timestamps (if added later) must be UTC ISO-8601.
- No network access required to consume the corpus.
MVP cases (stubs, to be replaced with real artifacts)
- Go:
go-ssh-CVE-2020-9283-keyexchange - .NET:
dotnet-kestrel-CVE-2023-44487-http2-rapid-reset - Python:
python-django-CVE-2019-19844-sqli-like - Rust:
rust-axum-header-parsing-TBD
CI intent
CorpusFixtureTestsvalidates presence and hashes from the manifest; hook this into CI once repo build stabilises.