Minimal Reachability Subgraph Attestation

Module

Attestor

VERIFIED

Stores minimal call/data/control edge subgraphs connecting entrypoints to vulnerable sinks as attested evidence.

Reachability Subgraph Predicate: src/Attestor/__Libraries/StellaOps.Attestor.ProofChain/Predicates/ReachabilitySubgraphPredicate.cs -- predicate containing the minimal subgraph (nodes and edges) connecting entrypoints to vulnerable sinks.
Reachability Subgraph Statement: Statements/ReachabilitySubgraphStatement.cs -- in-toto statement wrapping the subgraph predicate for DSSE signing.
Witness Path Nodes: Statements/WitnessPathNode.cs -- individual node in the subgraph (function name, file, line, module).
Witness Call Path Nodes: Statements/WitnessCallPathNode.cs -- call-graph node with caller/callee relationship.
Witness Gate Info: Statements/WitnessGateInfo.cs -- gate (security check, validation) along the path.
Witness Evidence Metadata: Statements/WitnessEvidenceMetadata.cs -- metadata about the analysis that produced the subgraph.
Proof Graph Subgraph: Graph/ProofGraphSubgraph.cs -- generic subgraph extraction from the proof graph (used to extract minimal subgraphs).
Proof Graph Path: Graph/ProofGraphPath.cs -- traversal path through the graph.
Reachability Witness Payload: Statements/ReachabilityWitnessPayload.cs (with .Path) -- payload with the full witness including call path.
DSSE Signing: Signing/ProofChainSigner.cs -- signs subgraph attestations into DSSE envelopes.
Tests: __Tests/StellaOps.Attestor.ProofChain.Tests/ReachabilitySubgraphTests.cs

Create a ReachabilitySubgraphPredicate with a minimal subgraph (entrypoint -> intermediate -> vulnerable sink) and verify all nodes and edges are present
Build a ReachabilitySubgraphStatement and sign it via ProofChainSigner; verify the DSSE envelope is valid
Create a subgraph with a WitnessGateInfo (e.g., input validation) along the path and verify the gate is captured
Verify WitnessEvidenceMetadata captures the analysis tool, language, and confidence for the subgraph
Extract a minimal subgraph from a larger InMemoryProofGraphService graph using ProofGraphSubgraph and verify it contains only the relevant path
Create a subgraph with multiple paths to the same sink and verify all paths are captured
Verify the subgraph predicate content-addressed ID is deterministic: same subgraph produces the same ID

Check	Result
Tier 0 - Source Verification	PASS
Tier 1 - Build + Code Review	PASS
Tier 2 - Behavioral Verification	PASS
Verified Date	2026-02-13
Run ID	run-001