Marius CiepluchandClaude Opus 4.8 04667c815e measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy ...

Ran ousast scan --mode deep on the 5 app-shaped + sound pool targets (the fair change-scoped
eval set from the shape classification). Detection 3/5: graphiti (hunter, Cypher injection),
mcp-remote (hunter, url-scheme injection), dcmcp (ENGINE overlay -- 'outbound.request reached
from parameter' on readFileFromUrl; parameter-as-source fired because an entry point is present).
2/5 missed: malla (DOM/template XSS) and dms (Jinja SSTI), both in families families.toml
documents as limited.

This validates the strategic pivot: the near-zero catch was substantially a TARGET MISMATCH --
on app-shaped repos the engine itself detects (0 -> 3/5). But all hits stop at suspicion/
static_corroboration; release-grade BLOCK still needs proof-arm elevation + family coverage +
the DSPy hint loop. Cost ~$0.007/repo. So bet #1 (fix eval target) is necessary and material
but not sufficient.

Next: recompute a floor on an app-shaped sound subset / real app corpus (VAmPI, NodeGoat,
DjanGoat, vibe-py); measure proof-arm suspicion->proven lift.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-10-12 11:16:35 +02:00

..

dcmcp-findings.json

measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

2026-10-12 11:16:35 +02:00

dms-findings.json

measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

2026-10-12 11:16:35 +02:00

malla-findings.json

measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

2026-10-12 11:16:35 +02:00

mcpremote-findings.json

measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

2026-10-12 11:16:35 +02:00

NOTES.md

measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

2026-10-12 11:16:35 +02:00