552 lines
24 KiB
Markdown
552 lines
24 KiB
Markdown
# Reachability Module Architecture
|
|
|
|
## Overview
|
|
|
|
The **Reachability** module provides a unified hybrid reachability analysis system that combines static call-graph analysis with runtime execution evidence to determine whether vulnerable code paths are actually exploitable in a given artifact. It serves as the **evidence backbone** for VEX (Vulnerability Exploitability eXchange) verdicts.
|
|
|
|
## Problem Statement
|
|
|
|
Vulnerability scanners generate excessive false positives:
|
|
- **Static analysis** over-approximates: flags code that is dead, feature-gated, or unreachable
|
|
- **Runtime analysis** under-approximates: misses rarely-executed but exploitable paths
|
|
- **No unified view** across static and runtime evidence sources
|
|
- **Symbol mismatch** between static extraction (Roslyn, ASM) and runtime observation (ETW, eBPF)
|
|
|
|
### Before Reachability Module
|
|
|
|
| Question | Answer Method | Limitation |
|
|
|----------|---------------|------------|
|
|
| Is CVE reachable statically? | Query ReachGraph | No runtime context |
|
|
| Was CVE executed at runtime? | Query Signals runtime facts | No static context |
|
|
| Should we mark CVE as NA? | Manual analysis | No evidence, no audit trail |
|
|
| What's the confidence? | Guesswork | No formal model |
|
|
|
|
### After Reachability Module
|
|
|
|
Single `IReachabilityIndex.QueryHybridAsync()` call returns:
|
|
- Lattice state (8-level certainty model)
|
|
- Confidence score (0.0-1.0)
|
|
- Evidence URIs (auditable, reproducible)
|
|
- Recommended VEX status + justification
|
|
|
|
---
|
|
|
|
## Module Location
|
|
|
|
```
|
|
src/__Libraries/StellaOps.Reachability.Core/
|
|
├── IReachabilityIndex.cs # Main facade interface
|
|
├── ReachabilityIndex.cs # Implementation
|
|
├── ReachabilityQueryOptions.cs # Query configuration
|
|
├── Models/
|
|
│ ├── SymbolRef.cs # Symbol reference
|
|
│ ├── CanonicalSymbol.cs # Canonicalized symbol
|
|
│ ├── StaticReachabilityResult.cs # Static query result
|
|
│ ├── RuntimeReachabilityResult.cs # Runtime query result
|
|
│ ├── HybridReachabilityResult.cs # Combined result
|
|
│ └── LatticeState.cs # 8-state lattice enum
|
|
├── Symbols/
|
|
│ ├── ISymbolCanonicalizer.cs # Symbol normalization interface
|
|
│ ├── SymbolCanonicalizer.cs # Implementation
|
|
│ ├── Normalizers/
|
|
│ │ ├── DotNetSymbolNormalizer.cs # .NET symbols
|
|
│ │ ├── JavaSymbolNormalizer.cs # Java symbols
|
|
│ │ ├── NativeSymbolNormalizer.cs # C/C++/Rust
|
|
│ │ └── ScriptSymbolNormalizer.cs # JS/Python/PHP
|
|
│ └── SymbolMatchOptions.cs # Matching configuration
|
|
├── CveMapping/
|
|
│ ├── ICveSymbolMappingService.cs # CVE-symbol mapping interface
|
|
│ ├── CveSymbolMappingService.cs # Implementation
|
|
│ ├── CveSymbolMapping.cs # Mapping record
|
|
│ ├── VulnerableSymbol.cs # Vulnerable symbol record
|
|
│ ├── MappingSource.cs # Source enum
|
|
│ └── Extractors/
|
|
│ ├── IPatchSymbolExtractor.cs # Patch analysis interface
|
|
│ ├── GitDiffExtractor.cs # Git diff parsing
|
|
│ ├── OsvEnricher.cs # OSV API enrichment
|
|
│ └── DeltaSigMatcher.cs # Binary signature matching
|
|
├── Lattice/
|
|
│ ├── ReachabilityLattice.cs # Lattice state machine
|
|
│ ├── LatticeTransition.cs # State transitions
|
|
│ └── ConfidenceCalculator.cs # Confidence scoring
|
|
├── Evidence/
|
|
│ ├── EvidenceUriBuilder.cs # stella:// URI construction
|
|
│ ├── EvidenceBundle.cs # Evidence collection
|
|
│ └── EvidenceAttestationService.cs # DSSE signing
|
|
└── Integration/
|
|
├── ReachGraphAdapter.cs # ReachGraph integration
|
|
├── SignalsAdapter.cs # Signals integration
|
|
└── PolicyEngineAdapter.cs # Policy Engine integration
|
|
```
|
|
|
|
---
|
|
|
|
## Core Concepts
|
|
|
|
### 1. Reachability Lattice (8-State Model)
|
|
|
|
The lattice provides mathematically sound evidence aggregation:
|
|
|
|
```
|
|
X (Contested)
|
|
/ \
|
|
/ \
|
|
CR (Confirmed CU (Confirmed
|
|
Reachable) Unreachable)
|
|
| \ / |
|
|
| \ / |
|
|
RO (Runtime RU (Runtime
|
|
Observed) Unobserved)
|
|
| |
|
|
| |
|
|
SR (Static SU (Static
|
|
Reachable) Unreachable)
|
|
\ /
|
|
\ /
|
|
U (Unknown)
|
|
```
|
|
|
|
| State | Code | Description | Confidence Base |
|
|
|-------|------|-------------|-----------------|
|
|
| Unknown | U | No analysis performed | 0.00 |
|
|
| Static Reachable | SR | Call graph shows path exists | 0.30 |
|
|
| Static Unreachable | SU | Call graph proves no path | 0.40 |
|
|
| Runtime Observed | RO | Symbol executed at runtime | 0.70 |
|
|
| Runtime Unobserved | RU | Observation window passed, no execution | 0.60 |
|
|
| Confirmed Reachable | CR | Multiple sources confirm reachability | 0.90 |
|
|
| Confirmed Unreachable | CU | Multiple sources confirm no reachability | 0.95 |
|
|
| Contested | X | Evidence conflict | 0.20 (requires review) |
|
|
|
|
### 2. Symbol Canonicalization
|
|
|
|
Symbols from different sources must be normalized to enable matching:
|
|
|
|
| Source | Raw Format | Canonical Format |
|
|
|--------|-----------|------------------|
|
|
| Roslyn (.NET) | `StellaOps.Scanner.Core.SbomGenerator::GenerateAsync` | `stellaops.scanner.core/sbomgenerator/generateasync/(cancellationtoken)` |
|
|
| ASM (Java) | `org/apache/log4j/core/lookup/JndiLookup.lookup(Ljava/lang/String;)Ljava/lang/String;` | `org.apache.log4j.core.lookup/jndilookup/lookup/(string)` |
|
|
| eBPF (Native) | `_ZN4llvm12DenseMapBaseINS_...` | `llvm/densemapbase/operator[]/(keytype)` |
|
|
| ETW (.NET) | `MethodID=12345 ModuleID=67890` | (resolved via metadata) |
|
|
|
|
### 3. CVE-Symbol Mapping
|
|
|
|
Maps CVE identifiers to specific vulnerable symbols:
|
|
|
|
```json
|
|
{
|
|
"cveId": "CVE-2021-44228",
|
|
"symbols": [
|
|
{
|
|
"canonicalId": "sha256:abc123...",
|
|
"displayName": "org.apache.log4j.core.lookup/jndilookup/lookup/(string)",
|
|
"type": "Sink",
|
|
"condition": "When lookup string contains ${jndi:...}"
|
|
}
|
|
],
|
|
"source": "PatchAnalysis",
|
|
"confidence": 0.98,
|
|
"patchCommitUrl": "https://github.com/apache/logging-log4j2/commit/abc123"
|
|
}
|
|
```
|
|
|
|
### 4. Evidence URIs
|
|
|
|
Standardized `stella://` URI scheme for evidence references:
|
|
|
|
| Pattern | Example |
|
|
|---------|---------|
|
|
| `stella://reachgraph/{digest}` | `stella://reachgraph/blake3:abc123` |
|
|
| `stella://reachgraph/{digest}/slice?symbol={id}` | `stella://reachgraph/blake3:abc123/slice?symbol=sha256:def` |
|
|
| `stella://signals/runtime/{tenant}/{artifact}` | `stella://signals/runtime/acme/sha256:abc` |
|
|
| `stella://cvemap/{cveId}` | `stella://cvemap/CVE-2021-44228` |
|
|
| `stella://attestation/{digest}` | `stella://attestation/sha256:sig789` |
|
|
|
|
---
|
|
|
|
## Architecture Diagram
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────────┐
|
|
│ Reachability Core Library │
|
|
├─────────────────────────────────────────────────────────────────────────────────┤
|
|
│ │
|
|
│ ┌────────────────────────────────────────────────────────────────────────────┐ │
|
|
│ │ IReachabilityIndex │ │
|
|
│ │ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────────────────┐ │ │
|
|
│ │ │ QueryStaticAsync │ │ QueryRuntimeAsync│ │ QueryHybridAsync │ │ │
|
|
│ │ └────────┬────────┘ └────────┬────────┘ └────────────┬───────────────┘ │ │
|
|
│ └───────────┼────────────────────┼─────────────────────────┼────────────────┘ │
|
|
│ │ │ │ │
|
|
│ ▼ ▼ ▼ │
|
|
│ ┌─────────────────────────────────────────────────────────────────────────────┐│
|
|
│ │ Internal Components ││
|
|
│ │ ││
|
|
│ │ ┌────────────────┐ ┌────────────────┐ ┌────────────────────────────┐ ││
|
|
│ │ │ Symbol │ │ CVE-Symbol │ │ Reachability │ ││
|
|
│ │ │ Canonicalizer │ │ Mapping │ │ Lattice │ ││
|
|
│ │ │ │ │ │ │ │ ││
|
|
│ │ │ ┌────────────┐ │ │ ┌────────────┐ │ │ ┌───────────────────────┐ │ ││
|
|
│ │ │ │.NET Norm. │ │ │ │PatchExtract│ │ │ │ State Machine │ │ ││
|
|
│ │ │ │Java Norm. │ │ │ │OSV Enrich │ │ │ │ Confidence Calc │ │ ││
|
|
│ │ │ │Native Norm.│ │ │ │DeltaSig │ │ │ │ Transition Rules │ │ ││
|
|
│ │ │ │Script Norm.│ │ │ │Manual Input│ │ │ └───────────────────────┘ │ ││
|
|
│ │ │ └────────────┘ │ │ └────────────┘ │ │ │ ││
|
|
│ │ └────────────────┘ └────────────────┘ └────────────────────────────┘ ││
|
|
│ │ ││
|
|
│ └──────────────────────────────────────────────────────────────────────────────┘│
|
|
│ │ │
|
|
│ ▼ │
|
|
│ ┌──────────────────────────────────────────────────────────────────────────────┐│
|
|
│ │ Evidence Layer ││
|
|
│ │ ││
|
|
│ │ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────────────────┐ ││
|
|
│ │ │ Evidence URI │ │ Evidence Bundle │ │ Evidence Attestation │ ││
|
|
│ │ │ Builder │ │ (Collection) │ │ Service (DSSE) │ ││
|
|
│ │ └─────────────────┘ └─────────────────┘ └─────────────────────────────┘ ││
|
|
│ │ ││
|
|
│ └──────────────────────────────────────────────────────────────────────────────┘│
|
|
│ │
|
|
└──────────────────────────────────────────────────────────────────────────────────┘
|
|
│
|
|
┌────────────────────────┼────────────────────────┐
|
|
│ │ │
|
|
▼ ▼ ▼
|
|
┌────────────────┐ ┌────────────────┐ ┌────────────────┐
|
|
│ ReachGraph │ │ Signals │ │ Policy Engine │
|
|
│ Adapter │ │ Adapter │ │ Adapter │
|
|
└───────┬────────┘ └───────┬────────┘ └───────┬────────┘
|
|
│ │ │
|
|
▼ ▼ ▼
|
|
┌────────────────┐ ┌────────────────┐ ┌────────────────┐
|
|
│ ReachGraph │ │ Signals │ │ Policy Engine │
|
|
│ WebService │ │ WebService │ │ (VEX Emit) │
|
|
└────────────────┘ └────────────────┘ └────────────────┘
|
|
```
|
|
|
|
---
|
|
|
|
## Data Flow
|
|
|
|
### Query Flow
|
|
|
|
```
|
|
1. Consumer calls IReachabilityIndex.QueryHybridAsync(symbol, artifact, options)
|
|
│
|
|
▼
|
|
2. SymbolCanonicalizer normalizes input symbol to CanonicalSymbol
|
|
│
|
|
▼
|
|
3. Parallel queries:
|
|
├── ReachGraphAdapter.QueryAsync() → StaticReachabilityResult
|
|
└── SignalsAdapter.QueryRuntimeFactsAsync() → RuntimeReachabilityResult
|
|
│
|
|
▼
|
|
4. ReachabilityLattice computes combined state from evidence
|
|
│
|
|
▼
|
|
5. ConfidenceCalculator applies evidence weights and guardrails
|
|
│
|
|
▼
|
|
6. EvidenceBundle collects URIs for audit trail
|
|
│
|
|
▼
|
|
7. Return HybridReachabilityResult with verdict recommendation
|
|
```
|
|
|
|
### Ingestion Flow (CVE Mapping)
|
|
|
|
```
|
|
1. Patch commit detected (Concelier, Feedser, or manual)
|
|
│
|
|
▼
|
|
2. GitDiffExtractor parses diff to find changed functions
|
|
│
|
|
▼
|
|
3. SymbolCanonicalizer normalizes extracted symbols
|
|
│
|
|
▼
|
|
4. OsvEnricher adds context from OSV database
|
|
│
|
|
▼
|
|
5. CveSymbolMappingService persists mapping with provenance
|
|
│
|
|
▼
|
|
6. Mapping available for reachability queries
|
|
```
|
|
|
|
---
|
|
|
|
## API Contracts
|
|
|
|
### IReachabilityIndex
|
|
|
|
```csharp
|
|
public interface IReachabilityIndex
|
|
{
|
|
/// <summary>
|
|
/// Query static reachability from call graph.
|
|
/// </summary>
|
|
Task<StaticReachabilityResult> QueryStaticAsync(
|
|
SymbolRef symbol,
|
|
string artifactDigest,
|
|
CancellationToken ct);
|
|
|
|
/// <summary>
|
|
/// Query runtime reachability from observed facts.
|
|
/// </summary>
|
|
Task<RuntimeReachabilityResult> QueryRuntimeAsync(
|
|
SymbolRef symbol,
|
|
string artifactDigest,
|
|
TimeSpan observationWindow,
|
|
CancellationToken ct);
|
|
|
|
/// <summary>
|
|
/// Query hybrid reachability combining static + runtime.
|
|
/// </summary>
|
|
Task<HybridReachabilityResult> QueryHybridAsync(
|
|
SymbolRef symbol,
|
|
string artifactDigest,
|
|
HybridQueryOptions options,
|
|
CancellationToken ct);
|
|
|
|
/// <summary>
|
|
/// Batch query for CVE vulnerability analysis.
|
|
/// </summary>
|
|
Task<IReadOnlyList<HybridReachabilityResult>> QueryBatchAsync(
|
|
IEnumerable<SymbolRef> symbols,
|
|
string artifactDigest,
|
|
HybridQueryOptions options,
|
|
CancellationToken ct);
|
|
|
|
/// <summary>
|
|
/// Get vulnerable symbols for a CVE.
|
|
/// </summary>
|
|
Task<CveSymbolMapping?> GetCveMappingAsync(
|
|
string cveId,
|
|
CancellationToken ct);
|
|
}
|
|
```
|
|
|
|
### Result Types
|
|
|
|
```csharp
|
|
public sealed record HybridReachabilityResult
|
|
{
|
|
public required SymbolRef Symbol { get; init; }
|
|
public required string ArtifactDigest { get; init; }
|
|
public required LatticeState LatticeState { get; init; }
|
|
public required double Confidence { get; init; }
|
|
public required StaticEvidence? StaticEvidence { get; init; }
|
|
public required RuntimeEvidence? RuntimeEvidence { get; init; }
|
|
public required VerdictRecommendation Verdict { get; init; }
|
|
public required ImmutableArray<string> EvidenceUris { get; init; }
|
|
public required DateTimeOffset ComputedAt { get; init; }
|
|
public required string ComputedBy { get; init; }
|
|
}
|
|
|
|
public sealed record VerdictRecommendation
|
|
{
|
|
public required VexStatus Status { get; init; }
|
|
public VexJustification? Justification { get; init; }
|
|
public required ConfidenceBucket ConfidenceBucket { get; init; }
|
|
public string? ImpactStatement { get; init; }
|
|
public string? ActionStatement { get; init; }
|
|
}
|
|
|
|
public enum LatticeState
|
|
{
|
|
Unknown = 0,
|
|
StaticReachable = 1,
|
|
StaticUnreachable = 2,
|
|
RuntimeObserved = 3,
|
|
RuntimeUnobserved = 4,
|
|
ConfirmedReachable = 5,
|
|
ConfirmedUnreachable = 6,
|
|
Contested = 7
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## Integration Points
|
|
|
|
### Upstream (Data Sources)
|
|
|
|
| Module | Interface | Data |
|
|
|--------|-----------|------|
|
|
| ReachGraph | `IReachGraphSliceService` | Static call-graph nodes/edges |
|
|
| Signals | `IRuntimeFactsService` | Runtime method observations |
|
|
| Scanner.CallGraph | `ICallGraphExtractor` | Per-artifact call graphs |
|
|
| Feedser | `IBackportProofService` | Patch analysis results |
|
|
|
|
### Downstream (Consumers)
|
|
|
|
| Module | Interface | Usage |
|
|
|--------|-----------|-------|
|
|
| Policy Engine | `IReachabilityAwareVexEmitter` | VEX verdict with evidence |
|
|
| VexLens | `IReachabilityIndex` | Consensus enrichment |
|
|
| Web Console | REST API | Evidence panel display |
|
|
| CLI | `stella reachability` | Command-line queries |
|
|
| ExportCenter | `IReachabilityExporter` | Offline bundles |
|
|
|
|
---
|
|
|
|
## Storage
|
|
|
|
### PostgreSQL Schema
|
|
|
|
```sql
|
|
-- CVE-Symbol Mappings
|
|
CREATE TABLE reachability.cve_symbol_mappings (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
tenant_id UUID NOT NULL,
|
|
cve_id TEXT NOT NULL,
|
|
symbol_canonical_id TEXT NOT NULL,
|
|
symbol_display_name TEXT NOT NULL,
|
|
vulnerability_type TEXT NOT NULL,
|
|
condition TEXT,
|
|
source TEXT NOT NULL,
|
|
confidence DECIMAL(3,2) NOT NULL,
|
|
patch_commit_url TEXT,
|
|
delta_sig_digest TEXT,
|
|
extracted_at TIMESTAMPTZ NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
UNIQUE (tenant_id, cve_id, symbol_canonical_id)
|
|
);
|
|
|
|
-- Query Cache
|
|
CREATE TABLE reachability.query_cache (
|
|
cache_key TEXT PRIMARY KEY,
|
|
artifact_digest TEXT NOT NULL,
|
|
symbol_canonical_id TEXT NOT NULL,
|
|
lattice_state INTEGER NOT NULL,
|
|
confidence DECIMAL(3,2) NOT NULL,
|
|
result_json JSONB NOT NULL,
|
|
computed_at TIMESTAMPTZ NOT NULL,
|
|
expires_at TIMESTAMPTZ NOT NULL
|
|
);
|
|
|
|
-- Audit Log
|
|
CREATE TABLE reachability.query_audit_log (
|
|
id BIGSERIAL PRIMARY KEY,
|
|
tenant_id UUID NOT NULL,
|
|
query_type TEXT NOT NULL,
|
|
artifact_digest TEXT NOT NULL,
|
|
symbol_count INTEGER NOT NULL,
|
|
lattice_state INTEGER NOT NULL,
|
|
confidence DECIMAL(3,2) NOT NULL,
|
|
duration_ms INTEGER NOT NULL,
|
|
queried_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
```
|
|
|
|
### Valkey (Redis) Caching
|
|
|
|
| Key Pattern | TTL | Purpose |
|
|
|-------------|-----|---------|
|
|
| `reach:static:{artifact}:{symbol}` | 1h | Static query cache |
|
|
| `reach:runtime:{artifact}:{symbol}` | 5m | Runtime query cache |
|
|
| `reach:hybrid:{artifact}:{symbol}:{options_hash}` | 15m | Hybrid query cache |
|
|
| `cvemap:{cve_id}` | 24h | CVE mapping cache |
|
|
|
|
---
|
|
|
|
## Determinism Guarantees
|
|
|
|
### Reproducibility Rules
|
|
|
|
1. **Canonical Symbol IDs:** SHA-256 of `purl|namespace|type|method|signature` (lowercase, sorted)
|
|
2. **Stable Lattice Transitions:** Deterministic state machine, no randomness
|
|
3. **Ordered Evidence:** Evidence URIs sorted lexicographically
|
|
4. **Time Injection:** All `ComputedAt` via `TimeProvider`
|
|
5. **Culture Invariance:** `InvariantCulture` for all string operations
|
|
|
|
### Replay Verification
|
|
|
|
```csharp
|
|
public interface IReachabilityReplayService
|
|
{
|
|
Task<ReplayResult> ReplayAsync(
|
|
HybridReachabilityInputs inputs,
|
|
HybridReachabilityResult expected,
|
|
CancellationToken ct);
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## Performance Characteristics
|
|
|
|
| Operation | Target P95 | Notes |
|
|
|-----------|-----------|-------|
|
|
| Static query (cached) | <10ms | Valkey hit |
|
|
| Static query (uncached) | <100ms | ReachGraph slice |
|
|
| Runtime query (cached) | <5ms | Valkey hit |
|
|
| Runtime query (uncached) | <50ms | Signals lookup |
|
|
| Hybrid query | <50ms | Parallel static + runtime |
|
|
| Batch query (100 symbols) | <500ms | Parallelized |
|
|
| CVE mapping lookup | <10ms | Cached |
|
|
| Symbol canonicalization | <1ms | In-memory |
|
|
|
|
---
|
|
|
|
## Security Considerations
|
|
|
|
### Access Control
|
|
|
|
| Operation | Required Scope |
|
|
|-----------|---------------|
|
|
| Query reachability | `reachability:read` |
|
|
| Ingest CVE mapping | `reachability:write` |
|
|
| Admin CVE mapping | `reachability:admin` |
|
|
| Export bundles | `reachability:export` |
|
|
|
|
### Tenant Isolation
|
|
|
|
- All queries filtered by `tenant_id`
|
|
- RLS policies on all tables
|
|
- Cache keys include tenant prefix
|
|
|
|
### Data Sensitivity
|
|
|
|
- Symbol names may reveal internal architecture
|
|
- Runtime traces expose execution patterns
|
|
- CVE mappings are security-sensitive
|
|
|
|
---
|
|
|
|
## Observability
|
|
|
|
### Metrics
|
|
|
|
| Metric | Type | Labels |
|
|
|--------|------|--------|
|
|
| `reachability_query_duration_seconds` | histogram | query_type, cache_hit |
|
|
| `reachability_lattice_state_total` | counter | state |
|
|
| `reachability_cache_hit_ratio` | gauge | cache_type |
|
|
| `reachability_cvemap_count` | gauge | source |
|
|
|
|
### Traces
|
|
|
|
| Span | Description |
|
|
|------|-------------|
|
|
| `reachability.query.static` | Static graph query |
|
|
| `reachability.query.runtime` | Runtime facts query |
|
|
| `reachability.query.hybrid` | Combined computation |
|
|
| `reachability.canonicalize` | Symbol normalization |
|
|
| `reachability.lattice.compute` | State calculation |
|
|
|
|
---
|
|
|
|
## Related Documentation
|
|
|
|
- [Product Advisory: Hybrid Reachability](../../product/advisories/09-Jan-2026%20-%20Hybrid%20Reachability%20and%20VEX%20Integration%20(Revised).md)
|
|
- [ReachGraph Architecture](../reach-graph/architecture.md)
|
|
- [Signals Architecture](../signals/architecture.md)
|
|
- [VexLens Architecture](../vex-lens/architecture.md)
|
|
- [Sprint Index](../../implplan/SPRINT_20260109_009_000_INDEX_hybrid_reachability.md)
|
|
|
|
---
|
|
|
|
_Last updated: 09-Jan-2026_
|