reachability-triage
Static dependency vulnerability reachability analysis and advisory triage.
"Checks whether a vulnerable dependency is actually reachable from your code, to cut false alarms."
What it is
An async service that triages dependency vulnerabilities by checking whether the vulnerable code is actually reachable from your codebase, instead of reporting every advisory that matches a package version range. It builds an AST-based index of modules, symbol tables, call edges, and entrypoints to compute reachability verdicts via BFS.
What was hard
Dynamic dispatch (getattr, eval/exec, module-level __getattr__, and callbacks by reference) cannot always be statically resolved to a single symbol. A confident wrong answer is worse than an unresolved one: where dynamic dispatch cannot be resolved to a confident call target, the verdict degrades to unknown rather than emitting a false not_reachable.
What was measured
Phase 1 index and query layer were measured against a frozen corpus of 20 hand-labeled fixtures across four verdicts (reachable, reachable_only_from_tests, unknown, not_reachable). All pre-registered gates passed with zero false not_reachable classifications across 110 passing tests in the index and query layer test suite.
What is still open
TODO: Per-verdict precision/recall breakdown is currently unavailable and needed to evaluate per-verdict discriminator performance beyond the 20-fixture gate suite.
TODO: Phase 2 timing and accuracy figures (advisory resolution and agent loop) are currently unavailable while Phase 2 remains in progress.
Empirical Claims & Verification Invariants
| statement | value | sample | status | provenance |
|---|---|---|---|---|
| Phase 1 fixture-corpus measurement passed all pre-registered gates, including zero false not_reachable results. TODO: per-verdict precision/recall breakdown currently unavailable | pending measurement | 20 hand-labeled fixtures | Measured | L5 measurement protocol and gate run (scripts/measure_l5.py) |
| Test suite for the Phase 1 index and query layer. | 110 tests passing | index and query layer test suite | Measured | pytest test runner |