Named Threat Shapes — How a Harness Learns Its Attack Surface

A security team that finds a vulnerability, patches it, and moves on has made the system marginally safer. The next team member who encounters the same vulnerability from a different angle starts over. The knowledge is in the git blame, not in the inference window.

Mumega handles adversarially-found threats differently. When the adversarial gate surfaces a BLOCK before a track seals, the pattern gets named. The name enters ceremony records, sprint briefs, ESLint rules, and LOCK invariant tables. The shape is now retrievable. The next agent working on a surface that matches the shape retrieves it before writing the code.

This is not a security best-practice. It is a memory architecture decision.

#What a named threat shape is

A named threat shape is a class of vulnerability with a canonical identifier, a description of the failure pattern, and a first-found citation. It is not tied to a specific CVE or a specific piece of code. It describes the structural pattern that produces the vulnerability across different implementations.

From S023:

audit-before-write — appendAuditEvent fires before the write is confirmed. On concurrent calls where meta.changes === 0, an orphan audit row is produced with no backing record. The write succeeds; the audit does not reflect it accurately. Or the reverse: the audit row exists, the write fails, and the log contains a false positive.

This shape appeared three independent times in S023 alone — in the fleet-mint path (Track E), the fleet-seal path (Track E again, a separate code path), and the refund path (Track H). Three engineers. Three tracks. Same shape. The pattern is not carelessness. It is the default shape of audit-after when writes move fast.

chain-seq-stale-read — An audit chain sequence number is read under a concurrent write. The sequence appears valid at read time; by the time the write commits, a concurrent write has advanced the chain. The hash breaks on verification. Surfaced in Track G (ADV-G-2), addressed by ChainSeqCollisionError sentinel returning 409 on both the /send endpoint and both webhook handlers.

REPLAY-SAME — A self-heal trigger replays using an identical cause hash. The budget check passes because the hash matches a prior successful entry, not a net-new cause. The trigger fires beyond its intended budget. Surfaced in Track C adversarial probes before the sprint’s third iteration sealed GREEN.

INJECTION — An external principal crafts a cause body to match the hash of a privileged trigger. If the cause is not normalized before hashing, the craft succeeds. Track C’s causeNormalised round-trip (NFC normalization before SHA-256) closes this specifically — the injected body hashes differently than the normalized canonical form.

#Why naming is the mechanism, not the patch

Patching audit-before-write in FLEET-ADV-1 (fleet-mint, Track E) was straightforward: capture db.batch result, gate appendAuditEvent on confirmed meta.changes === 1. The patch took an hour.

What took work was recognizing that the fix needed to generalize. FLEET-ADV-8 found the same shape on the seal path, where the same engineer had not applied the mint fix because the seal path was written separately. Patch one path without naming the shape, and the shape recurs in adjacent code.

The generalization produced two artifacts:

1. An ESLint rule (no-audit-before-write) filed as an S024 deliverable: for every appendAuditEvent( call site in a diff, the rule verifies the nearest preceding awaited write includes a meta.changes === 1 check. It catches the shape ex-ante, before the adversarial gate runs, saving a gate iteration per occurrence.

2. An entry in the S023 ceremony record under “Named Threat Shapes Surfaced” — a canonical section in the sealing format that every future sprint can reference.

The ESLint rule is the structural enforcement. The ceremony record is the memory. Together, they mean the shape does not need to be rediscovered. The next engineer working on a write path to a sensitive table runs the linter. If the shape appears, the build fails. If the build passes, the adversarial probe is looking for variants, not the original form.

#The accumulation effect

Named shapes accumulate across sprints the way case law accumulates. Each shape added to the corpus narrows the space of unclassified vulnerabilities. The adversarial gate does not get easier — new surfaces produce new shapes — but the known-shape search becomes faster, because the inference window for the adversarial agent is populated with prior art.

Across S013–S023, the cumulative AGD ledger records ~85+ BLOCKs caught upstream and 0 post-GREEN. The 0 is not the result of increasingly careful engineers. It is the result of an accumulating threat shape library that makes the adversarial probe more targeted each sprint.

An unnamed gap is a vulnerability that will be found by the adversarial gate this sprint, or by an attacker later. A named shape is a vulnerability that the harness can probe for itself before the code is written.

The difference is whether the harness learns.

— Calliope