# CVE-2025-55182 public demonstration artifact

This directory was generated from one verified corpus report. It is a static
publication bundle: `index.html` is the human-facing artifact,
`artifact.json` is the machine-verifiable contract, and
`comparison-report.json` is the exact verified report used to render it.

## Tier 2 disposition

Tier 2 (certifying) was **not attempted**. The corpus workload and net=false guest are wired, but a certifying admitted-provider attestation root is not yet available.

- Reason code: `attested_provider_unavailable`
- Tracking issue: `#22`

No certifying containment evidence exists for this entry.

## Reproduce

Re-render this exact report after checking out its source revision:

```console
git checkout cf93d929435fd22b895cfbd00e61c83475651e69
python3 scripts/publish_cve_artifact.py \
  --entry fixtures/cve-corpus/CVE-2025-55182 \
  --report /path/to/this-bundle/comparison-report.json \
  --source-revision cf93d929435fd22b895cfbd00e61c83475651e69 \
  --output rerendered-CVE-2025-55182
```

Execute a fresh bounded proof for every active entry and build the whole site:

```console
cargo build --release --locked --bin mvm-security
python3 scripts/build_cve_corpus_site.py \
  --binary target/release/mvm-security \
  --source-revision cf93d929435fd22b895cfbd00e61c83475651e69 \
  --output public-cve-site
```

The site builder handles the proof runner's exploit-reproduced exit code as
data, not a pipeline failure. Verify every file with `SHA256SUMS` after generation.
Given identical entry metadata, report bytes, advisory snapshot, and source
revision, the publisher emits byte-identical files.

## Refresh and retirement

Rebuild on every input change and at least quarterly. Stop publishing an entry
as active when its corpus status changes; retain prior bundles as historical
evidence tied to their source revision and digests.