Internals
These notes explain the implementation boundaries that contributors most often need before changing execution code. They describe the current alpha behavior, including limitations; they are not promises of a stable internal API.
Map
ScannerSdk
|
v
ScanRunner -----> EventBus
|
v
ScanPhase
Plugin host ----> host-created request ----> PluginRegistry
|
v
invocation PluginContext ----> Plugin::execute
| |
v v
bounded broker evidence recorder
DecisionLoop ---> DecisionRunnerAdapter ---> DecisionActionExecutor
|
v
KnowledgeBase
HTTP target ---> StandardWebDecisionRuntime
|
v
HttpEvidenceExecutor ---> typed Evidence
|
v
StandardWebDecisionProfile
|
v
StandardWebReasoning ---> Hypotheses
|
v
StandardWebAttackProfile
|
v
AttackPlan
|
v
StandardWebDiscoveryExecutorProfile
|
v
HttpEvidenceExecutor
|
v
StandardWebVerificationProfile
|
v
Outcome
Authorized JSON pair --> ApiVisibilityComparator --> comparison observation
|
v
KnowledgeBase + relation
|
v
StandardApiReasoning
|
v
resource review projection
Explicit host --> TaskQueue <--> WorkerPool --> WorkerNode
| |
| `--> CompletionReceipt --> ResultAggregator
`--> LuaScriptRegistry --> fresh bounded Lua VM
Bounded manifest bytes --> termivar-exploit validation --> sealed metadata catalog
(no execution runtime)
- Scheduler: explicit-time revisioned queue/worker assignment, logical ownership, retry/recovery, and bounded result-retention boundaries.
- Lua execution: approved-root source snapshots, private VM host API, cooperative budgets/cancellation, and receipt/provenance limits.
- Event bus: synchronous publication, subscriptions, history, and correlation.
- Runner: ordered phase execution, timeouts, cancellation, and partial results.
- Decision runner: command execution, executor routing, evidence provenance, and verifier handoff.
- Declarative policy wire contracts: fail-closed semantic fields, compatibility guards, and host loader limits.
- HTTP evidence executor: scope policy, bounded collection, typed observations, and rate-limit normalization.
- Scanner conformance corpus: strict repository-only sanitized request/response cases, deterministic validation, and the boundary between contract checks and empirical accuracy.
- API predicate vocabulary: canonical and normalized HTTP/API predicates plus atomic evidence/resource-scope observation bundles.
- API visibility evidence: bounded JSON comparison, broker-backed authorization-context pairs, atomic ingestion receipts, and resource-scoped review projections.
- Authorization differential review: strict primary-only policy, move-only principal roles, four raw-value-free JSON views, replay stability, and the optional single-runtime resource integration.
- API reasoning: deterministic JSON/GraphQL fingerprinting, capped API evidence contributions, and review-only visibility-boundary hypotheses.
- GraphQL surface review: explicit anonymous opt-in, deterministic one-endpoint selection, bounded three-request introspection/replay, and informational claim authority.
- OpenAPI surface review: explicit anonymous opt-in, deterministic one-document selection, bounded bodyless GET/replay, and informational contract observation.
- Passive response secret-exposure review: explicit anonymous opt-in, zero-additional-request admission over committed complete textual GET bodies, a fixed bounded detector catalogue, and value-free reporting.
- Existing-connection TLS observation: explicit passive opt-in over successful responses already obtained by the broker, bounded value-free leaf-certificate facts, and honest backend unknowns without an extra request or handshake.
- Active TLS negotiation review: explicit experimental opt-in for a fixed, parent-accounted TLS 1.3/TLS 1.2 handshake matrix, zero-network legacy rows, and no HTTP/application bytes, credentials, or server-support overclaim.
- Isolated HTTP parser-boundary laboratory: test-only numeric-loopback comparison of four fixed harmless single-message fixtures, with parent accounting and no CLI, product feature, second request, finding, or live-target authority.
- Local JWT and optional target-acceptance review: strict local ES256 policy evaluation plus a separate six-leg exact-resource target child, with guarded secret intake, value-free evidence, shared parent accounting, and no Confirmed claim.
- OAST correlation foundation: provider-neutral host-minted token binding, bounded caller-driven polls, typed DNS/HTTP events, replay suppression, and redacted receipts without network execution.
- Native OAST provider: unpublished self-hosted loopback service, fixed HTTPS management protocol, high-entropy Bearer credentials, bounded raw-free HTTP callback events, and explicit cleanup without scanner authority.
- Native OAST provider authority: non-default host-library adapter, exact HTTPS provider-origin permit, fixed management operations, parent-budget accounting, explicit lifecycle, and raw-free correlation reduction without a target action or report.
- SSRF OAST query review: explicit one-parameter target authority,
.invalidcontrol, two independent native-provider callbacks, bounded polling/cleanup, and repeated raw-free evidence withNeedsReview/KnowledgeOnlymaximum authority. - Controlled XML external-entity review: explicit disposable-endpoint authority, runtime-generated inert control/candidate/replay XML, two independent native-provider callbacks, bounded polling/cleanup, and repeated raw-free evidence with
NeedsReview/KnowledgeOnlymaximum authority. - Standard web decision profile: one-shot composition, installation transaction, and layer boundaries.
- Standard web decision runtime: target builder, bootstrap evidence, executable-plan filtering, resource budgets, and complete session driving.
- Web reasoning: standard ontology, explainable fingerprint rules, and Bayesian weak/strong hypotheses.
- Web planning: hypothesis-gated actions, utility ranking, policy exclusions, and executor contracts.
- Payload strategies: planner-selected revisions, deterministic derivation contract, redaction, and transport requirements.
- Normalization-resilience review: explicit opt-in, candidate-specific defense eligibility, typed depth-one HTML transforms, replay, and conservative claim authority.
- Web execution: semantic executor installation, discovery-only HTTP methods, and scope controls.
- Web verification: action/case isolation, passive/active rules, and conservative outcomes.
- Plugin registry: host-owned scope, request/evidence budgets, redaction, validation, execution, and accounting.
- Semantic producer contract: production evidence vocabulary compatibility for semantic entity extraction and explicit deferred gaps.
- ADR 0024: separate bounded exploit metadata/catalog contracts from the quarantined historical scanner scaffold and from future execution authority.
Cross-boundary changes should start in Architecture Decisions. Public contract changes must also follow the Plugin API policy.
