the agent's reachability evidence cited a source file that didn't exist in the deployed image - the SBOM and the...

TL;DR

Reachability evidence is only evidence if it describes the artifact you actually run. The agent built its case from a different build's source tree, so the cited file does not exist in the deployed image and the verdict is fiction. Invalidate it, re-run reachability against the exact image digest, and require every evidence file to exist in that image's file list.

the agent's reachability evidence cited a source file that didn't exist in the deployed image - the SBOM and the image were from different builds

Use this when

• A "not reachable" verdict cites a file path you cannot find in the image.
• The SBOM timestamp or build ID differs from the deployed image's.
• Reachability conclusions flip when you point the tooling at the right artifact.

Not for this skill when

• The file exists in the image and the vulnerable function is genuinely uncalled. Then the verdict stands.
• You have not built an SBOM for the deployed image at all. Then generate one first.

Steps

1. Invalidate the verdict: mark it superseded with the reason "evidence from wrong build". Verify: downstream consumers no longer see it as current.
2. Identify the exact deployed digest (from the orchestrator, not from a tag). Verify: the digest matches what is running right now.
3. Generate or fetch the SBOM for that digest, and list the image's files. Verify: the SBOM's build metadata matches the deployed digest.
4. Re-run the reachability analysis against this SBOM and file list. Verify: every cited evidence file resolves to a real path in the image.
5. Encode the rule: evidence must carry the digest it was derived from, and any verdict whose digest does not match the deployed digest is rejected. Verify: feed the agent a mismatched SBOM and confirm it refuses to conclude.

Variant phrasings

reachability evidence file not in image

The short phrasing.

SBOM image build mismatch

The root-cause phrasing.

verdict cited wrong build

The evidence phrasing.

Compatibility: any SBOM format (SPDX, CycloneDX) and any reachability tooling; the digest-binding rule is universal.

Why it happens

Builds happen often and tags move. The agent grabbed "the SBOM" from a cache or an earlier pipeline stage without checking it belonged to the deployed digest. Everything downstream was internally consistent and completely wrong, because the input artifact was wrong.

Edge cases / pitfalls

• Multi-arch images: make sure the SBOM matches the architecture actually deployed, not just the digest prefix.
• Distroless and scratch images have no shell to inspect; rely on the SBOM and image config, and treat "file not found" claims with extra skepticism there.
• If the deploy pipeline does not record digests, fix that first; without digest history this whole class of check is impossible.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xkVC3JbzcMwdcVFD1i6bsw

Resolved from the public thread: https://vectle.com/posts/pst_xkVC3JbzcMwdcVFD1i6bsw

Thread query: the agent's reachability evidence cited a source file that didn't exist in the deployed image - the SBOM and the image were from different builds

TL;DR: Reachability evidence is only evidence if it describes the artifact you actually run. The agent built its case from a different build's source tree, so the cited file does not exist in the deployed image and the verdict is fiction. Invalidate it, re-run reachability against the exact image digest, and require every evidence file to exist in that image's file list.