feat(reachability): distinguish present-static-binary from not-observed (JEF-404)

[thejefflarson]

Closes JEF-404

Problem

Reachability is proven by correlating a CVE's package against runtime LibraryLoaded events. Statically linked binaries (Go, CGO-disabled/musl-static) compile everything into one executable — there are no per-.so loads — so LibraryLoaded never names the vulnerable package and every CVE renders not-observed, even when the vulnerable code is genuinely on a hot path. Two harms: (a) false negatives on reachability for a whole image class; (b) not-observed reads to the adjudicator as "not running", so absence-of-evidence was being read as evidence-of-absence.

What changed

• New Reachability::PresentStaticBinary (label present-static-binary): distinct from not-observed ("observed absent"). The library-load correlation cannot fire for a static binary, so a would-be-not-observed CVE on such an image is indeterminate, not absent.
• Minimal, zero-dependency ELF static-linkage classifier (engine::observe::elf): a static ELF carries no PT_INTERP program header. Pure, byte-only, bounds-checked; honestly returns None on any malformed/unknown input. No new heavy crate, and it only inspects bytes already in hand — the zero-egress invariant holds.
• Image::static_binary: Option<bool> — the per-image signal the classifier populates. CveReachabilityAdapter tags PresentStaticBinary when the image is static and no load matched; a real LoadedAtRuntime match still wins (some static binaries dlopen a plugin).
• Prompt fed honestly: the tag is CONTEXT, never exploitation evidence (only loaded-at-runtime is), but explicitly NOT reassurance — its lack of a runtime load must not be read as safety. The JEF-402/405 evidence rules are untouched (loaded-at-runtime remains the sole CVE evidence).

Static-linkage signal chosen (and why)

The cheapest reliable signal is the ELF header (no PT_INTERP ⇒ static). I implemented a minimal, well-scoped ELF-header parser rather than pulling in goblin/object (zero-egress + no heavy dep). It reads only the ELF header and program-header table, short-circuits at the first PT_INTERP, and is fully unit-tested with tiny synthetic byte fixtures.

DECISION NEEDED (architect): the engine has no in-cluster access to the entrypoint binary bytes today (zero-egress, node-local agent), so static_binary stays None in production until an ELF-byte signal is plumbed in — e.g. the agent POSTing the entrypoint's linkage over the behavioral wire (ADR-0014), or a scanner-reported field. The enum + classifier + adapter + prompt are all wired and tested end-to-end; only the byte source is pending. None linkage means reachability behaves exactly as before this change, so nothing regresses in the interim.

Tests

• ELF fixtures: static vs dynamic classify differently; 32/64-bit; big-endian; non-ELF/truncated/malformed → None (never guess, never panic).
• A static image tags PresentStaticBinary while the same image dynamically-linked stays NotObserved, and a real matching load still yields LoadedAtRuntime.
• Reachability label round-trip (distinct token from not-observed).
• Prompt renders the tag and frames it as unknowable, not reassurance, without weakening the loaded-at-runtime-only CVE-evidence rule.

Checks

cargo fmt clean; cargo clippy --all-targets clean (warnings as errors); cargo test -p protector → 772 passed, 0 failed. All touched files under the 1000-line cap (tests split into elf/tests.rs).

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP

[thejefflarson]

Architect ratification (INTEGRATE / JEF-404 DECISION NEEDED)

RATIFIED: land-dormant is the correct call. The classifier + Reachability::PresentStaticBinary + adapter + prompt are fully wired and tested, with the byte source deferred. In production Image::static_binary is None at every construction site, so:

• reachability behaves exactly as before this PR (zero regression — None ⇒ prior NotObserved path),
• elf_static_linkage is never invoked in prod (no new attack surface reachable, zero-egress intact — the parser is a pure &[u8] -> Option<bool>).

Independently re-verified against the repo invariants:

• Decision logic unchanged: the breach definition (one of the three evidence types) is byte-for-byte unchanged; there is no Rust match mapping reachability to an evidence boolean — exploitability is the model's call (ADR-0013), driven by prompt text. present-static-binary is placed in the context-never-evidence register alongside not-observed, explicitly framed as NOT reassurance, and loaded-at-runtime remains the sole CVE evidence discriminator. PresentStaticBinary cannot become an exploitable path.
• ELF parser: bounds-checked throughout (.get() / checked_add / checked_mul), allocation-free, malformed/truncated -> None. No attacker-reachable panic in release.
• File-size cap honored (largest touched file 945 lines; ELF tests split into elf/tests.rs).

FOLLOW-UP (required, human): file a ticket to plumb an ELF-byte source so static_binary can be populated — either the agent posting linkage over the behavioral wire (ADR-0014) or a scanner-reported field. Until then the feature stays dormant by design.

HARDENING NIT (non-blocking, not reachable today): in the read helpers, bytes.get(off..off + N) computes off + N before the range is bounds-checked; a crafted e_phoff near u64::MAX would overflow that add and panic under a debug build (overflow-checks on). Not reachable in prod (release wraps to a start>end range -> None, and the parser isn't invoked in prod at all). Worth a checked_add in the helpers when the byte source lands and the parser goes live. Fold into the follow-up ticket.