Expand description
Deterministic evidence, reasoning, planning, execution, and verification for Termivar’s scanner runtime.
The default scanning feature contains the bounded decision runtime used by
termivar scan. The historical ordered phase runner and Scanner SDK are
available only through the non-default legacy-scanner feature. Native
plugins remain a separate source-level Preview contract under plugins.
KnowledgeBase separates ontology, instance knowledge, and observations
without coupling evidence producers to decision policy.
Re-exports§
pub use semantic::AuthArtifactKind;pub use semantic::EntityExtractor;pub use semantic::LimitsError;pub use semantic::SemanticEntity;pub use semantic::SemanticEntityType;pub use semantic::SemanticExtractionLimits;pub use semantic::SemanticExtractionResult;pub use api::ApiError;pub use api::ApiResponse;pub use api::ScanResultResponse;pub use api::ScanStatus;pub use api::ScanStatusType;pub use api::StartScanRequest;pub use api_evidence::ApiComparisonProfile;pub use api_evidence::ApiVisibilityComparator;pub use api_evidence::ApiVisibilityEvidenceError;pub use api_evidence::ApiVisibilityLimits;pub use api_evidence::ApiVisibilityView;pub use api_evidence::CanonicalizationVersion;pub use api_evidence::ComparisonAlgorithmVersion;pub use api_evidence::JsonPathPattern;pub use api_evidence::PathDigest;pub use api_evidence::ProfiledApiVisibilityComparison;pub use api_evidence::ProfiledApiVisibilityError;pub use api_evidence::ProfiledApiVisibilityView;pub use api_evidence::ProjectionPolicyId;pub use api_evidence::RedactedVisibilityDiff;pub use api_evidence::VisibilityExplanationDisposition;pub use api_evidence::CURRENT_API_COMPARISON_ALGORITHM_VERSION;pub use api_evidence::CURRENT_API_VISIBILITY_CANONICALIZATION_VERSION;pub use api_evidence::DEFAULT_API_VISIBILITY_CANONICAL_BYTES;pub use api_evidence::DEFAULT_API_VISIBILITY_DEPTH;pub use api_evidence::DEFAULT_API_VISIBILITY_DIFF_PATHS;pub use api_evidence::DEFAULT_API_VISIBILITY_FIELDS;pub use api_evidence::DEFAULT_API_VISIBILITY_NODES;pub use api_evidence::HARD_MAX_API_COMPARISON_PATH_BYTES;pub use api_evidence::HARD_MAX_API_COMPARISON_PATH_DEPTH;pub use api_evidence::HARD_MAX_API_COMPARISON_PROFILE_PATHS;pub use api_evidence::HARD_MAX_API_VISIBILITY_CANONICAL_BYTES;pub use api_evidence::HARD_MAX_API_VISIBILITY_DEPTH;pub use api_evidence::HARD_MAX_API_VISIBILITY_DIFF_PATHS;pub use api_evidence::HARD_MAX_API_VISIBILITY_FIELDS;pub use api_evidence::HARD_MAX_API_VISIBILITY_NODES;pub use api_gateway::ApiQuota;pub use api_gateway::RateLimitPolicy;pub use api_gateway::RateLimitStatus;pub use api_gateway::RateLimitStrategy;pub use api_gateway::RouteConfig;pub use api_observation::api_visibility_reviews_for_resource;pub use api_observation::api_visibility_reviews_for_resource_v2;pub use api_observation::ingest_api_visibility_observation;pub use api_observation::ApiObservationCommitReceipt;pub use api_observation::ApiObservationError;pub use api_observation::ApiObservationReceipt;pub use api_observation::ApiVisibilityReview;pub use api_observation::ApiVisibilityReviewCursor;pub use api_observation::ApiVisibilityReviewDisposition;pub use api_observation::ApiVisibilityReviewPage;pub use api_observation::ApiVisibilityReviewQuery;pub use api_observation::DEFAULT_API_VISIBILITY_REVIEW_SCAN_LIMIT;pub use api_observation::HARD_MAX_API_VISIBILITY_REVIEW_SCAN_LIMIT;pub use api_observation::MAX_API_VISIBILITY_REVIEW_CURSOR_BYTES;pub use api_observation::MAX_API_VISIBILITY_REVIEW_RATIONALE_BYTES;pub use api_observation::MAX_API_VISIBILITY_SOURCE_COMPONENT_BYTES;pub use api_reasoning::StandardApiInstallReport;pub use api_reasoning::StandardApiReasoning;pub use api_reasoning::StandardApiReasoningError;pub use api_reasoning::STANDARD_API_AXIOM_COUNT;pub use api_reasoning::STANDARD_API_CONCEPT_COUNT;pub use api_reasoning::STANDARD_API_RULE_COUNT;pub use auth::User;pub use auth::UserRole;pub use cache::CacheStats;pub use cache::LruCache;pub use config::ScanConfig;pub use config::ScanIntensity;pub use config_loader::ConfigLoader;pub use config_loader::ScanProfile as ScanningProfile;pub use context::ScanContext;pub use contracts::ScanPhase;pub use defense::defense_aware_plan;pub use defense::defense_aware_shadow_plan;pub use defense::DefenseAwareShadowPlan;pub use defense::DefenseFingerprint;pub use defense::DefenseInteractionClass;pub use defense::DefenseObservationContext;pub use defense::DefensePlanningPolicy;pub use defense::DefensePosture;pub use defense::DefenseProduct;pub use defense::DefenseResponse;pub use defense::DefenseState;pub use defense::DefenseStatusSignal;pub use defense::DefenseTransition;pub use defense::DefenseTransitionKind;pub use defense::FingerprintConfidence;pub use defense::InteractionDecision;pub use defense::ObservedOutcome;pub use defense::PlanAdjustment;pub use defense::PostureShift;pub use defense::ResourceDefenseObservation;pub use defense::ResourceDefenseSignal;pub use defense::ShadowPlanDelta;pub use defense::SuppressedAction;pub use defense::MAX_FINGERPRINT_BODY_SCAN_BYTES;pub use error::Result;pub use error::ScannerError;pub use event_bus::EventBus;pub use event_bus::EventHandler;pub use experience::ExperienceAssessment;pub use experience::ExperienceDisposition;pub use experience::ExperiencePolicy;pub use experience::ExperienceRecommendation;pub use experience::ExperienceRecord;pub use experience::ExperienceStore;pub use experience::ExperienceStoreError;pub use experience::ExperienceWrite;pub use knowledge::KnowledgeBase;pub use knowledge::KnowledgeBaseError;pub use knowledge::KnowledgeBaseStats;pub use knowledge::KnowledgeRecordKind;pub use knowledge::KnowledgeSnapshot;pub use knowledge::KnowledgeStore;Deprecated pub use knowledge::KnowledgeStoreError;Deprecated pub use knowledge::KnowledgeStoreStats;Deprecated pub use knowledge::KnowledgeWrite;pub use knowledge::MAX_KNOWLEDGE_RELATION_ENTITY_ID_BYTES;pub use knowledge::MAX_KNOWLEDGE_RELATION_EVIDENCE_IDS;pub use knowledge::MAX_KNOWLEDGE_RELATION_EVIDENCE_ID_BYTES;pub use knowledge::MAX_KNOWLEDGE_RELATION_ID_BYTES;pub use knowledge::MAX_KNOWLEDGE_RELATION_KIND_BYTES;pub use logging::LogEntry;pub use logging::LogLevel;pub use logging::Logger;pub use metrics::MetricsCollector;pub use metrics::MetricsSummary;pub use metrics::PhaseMetrics;pub use payload_strategies::standard_payload_strategies;pub use payload_strategies::ApiAuthorizationContextPairStrategy;pub use payload_strategies::HttpHeaderControlPairStrategy;pub use payload_strategies::PayloadEncoding;pub use payload_strategies::API_AUTHORIZATION_CONTEXT_PAIR_HEADER_NAME;pub use payload_strategies::API_AUTHORIZATION_CONTEXT_PAIR_ID;pub use payload_strategies::API_AUTHORIZATION_CONTEXT_PAIR_REVISION;pub use payload_strategies::HTTP_HEADER_CONTROL_PAIR_HEADER_NAME;pub use payload_strategies::HTTP_HEADER_CONTROL_PAIR_ID;pub use payload_strategies::HTTP_HEADER_CONTROL_PAIR_REVISION;pub use payload_strategy::PayloadArtifact;pub use payload_strategy::PayloadArtifactReceipt;pub use payload_strategy::PayloadSeed;pub use payload_strategy::PayloadStrategy;pub use payload_strategy::PayloadStrategyError;pub use payload_strategy::PayloadStrategyLimits;pub use payload_strategy::PayloadStrategyRef;pub use payload_strategy::PayloadStrategyRegistry;pub use payload_strategy::PayloadVariantRole;pub use payload_strategy::DEFAULT_MAX_PAYLOAD_ARTIFACT_BYTES;pub use payload_strategy::HARD_MAX_PAYLOAD_ARTIFACT_BYTES;pub use payload_strategy::HARD_MAX_PAYLOAD_STRATEGY_ID_BYTES;pub use planner::ActionCost;pub use planner::AttackAction;pub use planner::AttackPlan;pub use planner::AttackPlanner;pub use planner::BenefitScore;pub use planner::ExcludedAction;pub use planner::ExclusionReason;pub use planner::HypothesisSelector;pub use planner::PlanStep;pub use planner::PlannerError;pub use planner::PlannerWrite;pub use planner::PlanningContext;pub use planner::RequiredStrength;pub use planner::ResolvedVerificationTarget;pub use planner::RiskScore;pub use planner::UtilityBreakdown;pub use planner::UtilityScore;pub use planner::VerificationTarget;pub use rules::EvidenceAggregation;pub use rules::EvidenceCalibration;pub use rules::EvidenceSelector;pub use rules::Expression;pub use rules::ExpressionEvaluation;pub use rules::ExpressionTrace;pub use rules::HypothesisConclusion;pub use rules::KnowledgeLayer;pub use rules::ReasoningRule;pub use rules::RuleApplication;pub use rules::RuleEngine;pub use rules::RuleEngineError;pub use rules::RuleEvaluation;pub use rules::RuleWrite;pub use verification::apply_outcome;pub use verification::ActiveVerifier;pub use verification::PassiveVerifier;pub use verification::VerificationCase;pub use verification::VerificationError;pub use verification::VerificationPipeline;pub use verification::VerificationPipelineReport;pub use verification::VerificationReport;pub use verification::VerificationRule;pub use verification::VerificationRuleEvaluation;pub use verification::VerifierWrite;pub use web_actions::StandardWebActionKind;pub use web_actions::STANDARD_WEB_ACTION_COUNT;pub use web_actions::STANDARD_WEB_DISCOVERY_ACTIONS;pub use web_actions::STANDARD_WEB_DISCOVERY_ACTION_COUNT;pub use web_planning::StandardWebAttackInstallReport;pub use web_planning::StandardWebAttackProfile;pub use web_planning::StandardWebPlanningError;pub use web_reasoning::StandardWebInstallReport;pub use web_reasoning::StandardWebReasoning;pub use web_reasoning::StandardWebReasoningError;pub use web_reasoning::STANDARD_WEB_AXIOM_COUNT;pub use web_reasoning::STANDARD_WEB_CONCEPT_COUNT;pub use web_reasoning::STANDARD_WEB_RULE_COUNT;pub use web_verification::StandardWebVerificationError;pub use web_verification::StandardWebVerificationInstallReport;pub use web_verification::StandardWebVerificationProfile;pub use web_verification::STANDARD_WEB_VERIFICATION_RULE_COUNT;pub use runner::ScanRunner;pub use sdk::ScannerBuilder;pub use sdk::ScannerSdk;pub use adaptive::AdaptationLedger;pub use adaptive::AdaptationLimits;pub use adaptive::AdaptationRule;pub use adaptive::AdaptationRuleEvaluation;pub use adaptive::AdaptiveDecision;pub use adaptive::AdaptivePipeline;pub use adaptive::AdaptivePipelineError;pub use adaptive::AdaptiveRuleWrite;pub use adaptive::OutcomeSelector;pub use adaptive::PipelineDirective;pub use decision_loop::DecisionActionOrigin;pub use decision_loop::DecisionLoop;pub use decision_loop::DecisionLoopCommand;pub use decision_loop::DecisionLoopConfig;pub use decision_loop::DecisionLoopError;pub use decision_loop::DecisionLoopState;pub use decision_loop::DecisionOutcomeReport;pub use decision_loop::DecisionPlanningReport;pub use decision_loop::DecisionReasoningCommitReceipt;pub use decision_loop::DecisionSession;pub use decision_loop::DecisionSessionSummary;pub use decision_loop::DecisionSessionTransition;pub use decision_loop::DecisionStopReason;pub use decision_runner::DecisionActionExecutor;pub use decision_runner::DecisionEvidenceReceipt;pub use decision_runner::DecisionExecutionClass;pub use decision_runner::DecisionExecutionFailureKind;pub use decision_runner::DecisionExecutionFailureReceipt;pub use decision_runner::DecisionExecutionLimits;pub use decision_runner::DecisionExecutionRequest;pub use decision_runner::DecisionExecutionStage;pub use decision_runner::DecisionExecutorError;pub use decision_runner::DecisionExecutorRegistry;pub use decision_runner::DecisionRunnerAdapter;pub use decision_runner::DecisionRunnerError;pub use decision_runner::DecisionRunnerTurn;pub use runtime_budget::RuntimeBudget;pub use runtime_budget::RuntimeBudgetDimension;pub use runtime_budget::RuntimeLimitExceeded;pub use runtime_budget::RuntimeUsage;pub use runtime_budget::TransportDispatchAudit;pub use runtime_budget::TransportDispatchOutcome;pub use runtime_budget::TransportDispatchReceipt;pub use runtime_budget::DEFAULT_MAX_ACTIVE_VERIFICATIONS;pub use runtime_budget::DEFAULT_MAX_CONSECUTIVE_NO_PROGRESS_TURNS;pub use runtime_budget::DEFAULT_MAX_REQUEST_BODY_BYTES;pub use runtime_budget::DEFAULT_MAX_RESPONSE_BYTES;pub use runtime_budget::DEFAULT_MAX_SAME_ACTION_ATTEMPTS;pub use runtime_budget::DEFAULT_MAX_TOTAL_REQUESTS;pub use runtime_budget::DEFAULT_MAX_WALL_TIME_MS;pub use runtime_budget::HARD_MAX_TRANSPORT_DISPATCH_RECEIPTS;pub use http_evidence::HttpBodyCapture;pub use http_evidence::HttpEvidenceError;pub use http_evidence::HttpEvidenceExecutor;pub use http_evidence::HttpEvidencePolicy;pub use http_evidence::HttpHeaderPayloadBinding;pub use http_evidence::HttpProbe;pub use http_evidence::HttpProbeMethod;pub use http_evidence::HttpProbeProvider;pub use http_evidence::SubjectHttpProbeProvider;pub use http_evidence::DEFAULT_HTTP_BODY_LIMIT;pub use http_evidence::HTTP_EVIDENCE_EXECUTOR_ID;pub use http_evidence::MAX_HTTP_BODY_LIMIT;pub use web_execution::StandardWebDiscoveryExecutorProfile;pub use web_execution::StandardWebDiscoveryInstallReport;pub use web_execution::StandardWebExecutionError;pub use web_execution::STANDARD_WEB_DISCOVERY_EXECUTOR_COUNT;pub use web_decision::StandardWebDecisionError;pub use web_decision::StandardWebDecisionInstallReport;pub use web_decision::StandardWebDecisionProfile;pub use web_runtime::ApiVisibilityContextProbe;pub use web_runtime::ApiVisibilityDifferentialAudit;pub use web_runtime::ApiVisibilityDifferentialDisposition;pub use web_runtime::ApiVisibilityDifferentialRequest;pub use web_runtime::ApiVisibilityDifferentialRequestError;pub use web_runtime::ApiVisibilityInconclusiveReason;pub use web_runtime::ApiVisibilityLeg;pub use web_runtime::ApiVisibilityLegReceipt;pub use web_runtime::RuntimeApiVisibilityError;pub use web_runtime::RuntimeApiVisibilityExecutionError;pub use web_runtime::RuntimeApiVisibilityRunReport;pub use web_runtime::StandardWebDecisionFailureReceipt;pub use web_runtime::StandardWebDecisionRunReport;pub use web_runtime::StandardWebDecisionRuntime;pub use web_runtime::StandardWebDecisionRuntimeBuilder;pub use web_runtime::StandardWebDecisionRuntimeError;pub use web_runtime::StandardWebDecisionRuntimeTurn;pub use web_runtime::tls_negotiation_review_target_is_supported;pub use web_runtime::WebAssessmentTlsNegotiationReviewAudit;pub use web_runtime::WebAssessmentTlsNegotiationReviewCell;pub use web_runtime::TLS_NEGOTIATION_REVIEW_ACTION_TLS12;pub use web_runtime::TLS_NEGOTIATION_REVIEW_ACTION_TLS13;pub use web_runtime::TLS_NEGOTIATION_REVIEW_AUDIT_SCHEMA;pub use web_runtime::TLS_NEGOTIATION_REVIEW_CAPABILITY_ID;pub use web_runtime::TLS_NEGOTIATION_REVIEW_POLICY_ID;pub use decision_runner::PluginDecisionExecutor;pub use decision_runner::PluginExecutionRequestProvider;pub use persistence::ColumnDef;pub use persistence::EndpointRecord;pub use persistence::EntityType;pub use persistence::FindingRecord;pub use persistence::IndexDef;pub use persistence::ScanRecord;pub use persistence::SchemaManager;pub use persistence::TableSchema;pub use post_exploitation::AssessmentObservation;pub use post_exploitation::ObservationDisposition;pub use reporting::ReportError;pub use reporting::ReportFormat;pub use reporting::ReportGenerator;pub use reporting::MAX_RENDERED_REPORT_BYTES;pub use reporting::REPORT_DOCUMENT_SCHEMA;pub use realtime::EventStream;pub use realtime::RealtimeEvent;pub use realtime::RealtimeEventValidationError;pub use realtime::Subscription;pub use dashboard::DashboardConfig;pub use dashboard::DashboardOverview;pub use dashboard::FindingCard;pub use dashboard::FindingStatus;pub use dashboard::ScanCard;pub use dashboard::WidgetType;pub use advanced_detection::BehaviorIndicator;pub use advanced_detection::BehavioralAnalysisData;pub use advanced_detection::BehavioralSignature;pub use advanced_detection::BehavioralSignatureValidationError;pub use advanced_detection::CatalogRecordError;pub use advanced_detection::ComparisonOperator;pub use advanced_detection::IndicatorType;pub use advanced_detection::TechniqueCatalog;pub use advanced_detection::TechniqueCategory;pub use advanced_detection::TechniqueRecord;pub use advanced_detection::TransformationRule;pub use advanced_detection::TransformationRuleCatalog;pub use advanced_detection::TransformationType;pub use anomaly::DeviationDimension;pub use anomaly::ErrorKeywordMatcher;pub use anomaly::ResponseDeviation;pub use anomaly::ResponseDeviationValidationError;pub use ml::AnomalyPattern;pub use ml::AnomalyType;pub use ml::ClusterResult;pub use ml::ExploitStage;pub use ml::ExploitationChain;pub use ml::MlRecordValidationError;pub use ml::VulnerabilityPattern;pub use monitoring::BenchmarkResult;pub use monitoring::BenchmarkSuite;pub use monitoring::CountComparison;pub use monitoring::DurationComparison;pub use monitoring::PerformanceAnalyzer;pub use monitoring::PhaseProfile;pub use monitoring::ResourceMetrics;pub use monitoring::ScanComparison;pub use monitoring::ScanProfile;pub use compliance::AuditEventType;pub use compliance::AuditLogEntry;pub use compliance::AuditTrail;pub use compliance::ComplianceAssessment;pub use compliance::ComplianceCatalog;pub use compliance::ComplianceFramework;pub use compliance::ComplianceReport;pub use compliance::ComplianceReportCatalog;pub use compliance::ComplianceRequirement;pub use compliance::DataClassification;pub use compliance::DataProtectionCatalog;pub use compliance::DataProtectionRecord;pub use threat_intelligence::AlertAction;pub use threat_intelligence::AlertEvaluation;pub use threat_intelligence::AlertRule;pub use threat_intelligence::AlertRuleCatalog;pub use threat_intelligence::CVERecord;pub use threat_intelligence::CveCatalog;pub use threat_intelligence::InvalidCvssScore;pub use threat_intelligence::ThreatActorCatalog;pub use threat_intelligence::ThreatActorProfile;pub use threat_intelligence::ThreatFeedCatalog;pub use threat_intelligence::ThreatFeedEntry;pub use threat_intelligence::ThreatFeedSource;pub use threat_intelligence::ThreatSeverity;pub use plugin::Plugin;pub use plugin::PluginBudget;pub use plugin::PluginCategory;pub use plugin::PluginConfig;pub use plugin::PluginContext;pub use plugin::PluginError;pub use plugin::PluginExecutionRequest;pub use plugin::PluginExecutionResult;pub use plugin::PluginHttpMethod;pub use plugin::PluginHttpRequest;pub use plugin::PluginHttpResponse;pub use plugin::PluginMetadata;pub use plugin::PluginObservation;pub use plugin::PluginRedactionPolicy;pub use plugin::PluginRegistry;pub use plugin::PluginRequestBroker;pub use plugin::PluginUsage;pub use plugin::SecretRedactionPolicy;pub use plugin::PLUGIN_API_VERSION;
Modules§
- adaptive
- Outcome-driven adaptive execution policy.
- advanced_
detection - Experimental signal definitions and caller-scored technique catalogs.
- anomaly
- Experimental deviation records and text-marker matching.
- api
- REST API data models
- api_
evidence - Pure, bounded evidence preparation for paired API visibility comparisons.
- api_
gateway - API gateway policy records.
- api_
observation - Host-facing ingestion and projection for paired API visibility observations.
- api_
reasoning - Deterministic JSON, GraphQL, and paired-visibility reasoning.
- auth
- Identity metadata records.
- authorization_
review - Transport-neutral contracts for bounded authorization differential review.
- cache
- Bounded in-memory cache.
- compliance
- Caller-supplied compliance and audit records.
- config
- Caller-supplied scan-configuration records.
- config_
loader - In-memory profile models and registry.
- context
- Scan context: shared state for the historical
termivar legacy-scanpipeline. - contracts
- Stable data and execution contracts shared by scanner components.
- control_
reference_ mapping - Bounded, offline control-reference mapping for composed assessment items.
- dashboard
- Dashboard presentation records.
- decision_
loop - Deterministic orchestration across reasoning, planning, verification, adaptation, and experience.
- decision_
runner - Runner boundary for executing deterministic decision-loop commands.
- defense
- Observation-only defensive posture layer.
- error
- Error types and handling for Termivar Scanner
- event_
bus - Event Bus - Publish/Subscribe Event System
- experience
- Deterministic experience derived from verification outcomes.
- http_
evidence - Scope-bound HTTP collection for the decision runner.
- jwt_
policy_ review - Bounded, transport-free review of one explicitly supplied compact JWT.
- jwt_
target_ acceptance - Pure domain contracts for bounded JWT target-acceptance review.
- knowledge
- Thread-safe in-memory knowledge base for evidence-driven reasoning.
- logging
- Structured Logging System for Termivar Scanner
- metrics
- In-memory scan measurement records.
- ml
- Experimental research records for externally computed model output.
- monitoring
- In-memory scan measurement and comparison models.
- oast
- Provider-neutral OAST correlation state.
- openapi_
review - Transport-neutral, bounded OpenAPI document classification and cataloging.
- payload_
strategies - Native, built-in
crate::payload_strategy::PayloadStrategy - payload_
strategy - Deterministic, bounded contracts for planner-selected payload strategies.
- persistence
- Persistence record and schema metadata.
- phases
- Ordered scan phases for the historical
termivar legacy-scanpipeline. - planner
- Deterministic, budget-aware attack planning.
- plugin
- Host-owned contract for source-linked native plugins.
- post_
exploitation - Quarantined post-assessment metadata records.
- realtime
- Recorded event and subscription data models.
- recon_
ct_ provider - Bounded, transport-neutral core for Cert Spotter reconnaissance queries.
- recon_
snapshot - Strict, bounded import of finite offline reconnaissance snapshots.
- reporting
- Deterministic, bounded rendering for validated
termivar_core::RunReportvalues. - rest_
review - Pure OpenAPI-to-REST read-only operation selection.
- rules
- Deterministic expression evaluation and Bayesian reasoning rules.
- runner
- Typed orchestration for the opt-in historical phase scanner.
- runtime_
budget - Resource envelope for host-facing decision runtimes.
- sdk
- Public composition API for the opt-in historical scanner SDK.
- semantic
- Semantic Model Builder components: deterministic entity extraction from scanner evidence (Phase 1).
- ssrf_
oast_ review - Pure, bounded contracts for query-only repeated-callback SSRF review.
- supplied_
session_ review - Transport-neutral contracts for one explicitly supplied authorization session.
- template_
evaluation_ review - Raw-free contracts for one bounded benign template-evaluation review.
- threat_
intelligence - Offline threat-intelligence records, catalogs, and rule predicates.
- verification
- Deterministic passive and active verification.
- web_
actions - Transport-neutral semantic action identities for standard web profiles.
- web_
decision - One-shot composition of the standard deterministic web decision stack.
- web_
execution - Scope-bound executors for standard web discovery actions.
- web_
planning - Standard planner actions driven by web reasoning hypotheses.
- web_
reasoning - Standard deterministic ontology and reasoning rules for web observations.
- web_
runtime - Host-facing runtime for the standard deterministic web decision stack.
- web_
verification - Deterministic outcomes for standard web discovery evidence.
- websocket_
review - Strict, transport-neutral policy for bounded WebSocket review.
- wordpress_
review - Transport-free WordPress inventory and advisory interpretation.
- xml_
external_ entity_ review - Pure contracts for one bounded XML external-entity resolution review.
Structs§
- Aggregated
Result - One aggregate element in exact request order.
- ApiVisibility
Comparison - One host-paired API visibility comparison.
- ApiVisibility
Observation - One atomic API comparison observation plus its resource-scope graph edge.
- Completion
Receipt - Exact receipt for a terminal completion. Fields are intentionally private.
- Confidence
Score - An ordinal evidence score represented in basis points.
- Discovery
Form - Bounded parser-tree-descendant form observation.
- Discovery
Limits - Host-configurable resource envelope for legacy discovery phases two to four.
- Distributed
Limits - Hard coordinator bounds and fixed recovery policy.
- Entity
Id - Stable identifier for an entity in the knowledge graph.
- Event
- Versioned event data used by the opt-in historical scanner event bus.
- Event
Builder - Fluent builder for
Event. - Knowledge
Predicate - Namespaced predicate used by evidence, facts, and hypotheses.
- LuaCancellation
Token - Cloneable host cancellation signal checked from the VM instruction hook.
- LuaConfig
Error - Typed configuration validation failure.
- LuaContext
- Immutable host input exposed to Lua through read-only accessors.
- LuaEngine
Config - Resource configuration for one host-owned Lua registry.
- LuaExecution
Receipt - Bounded, privacy-minimized execution metadata retained by the registry.
- LuaExecution
Result - LuaScript
- Opaque executable source created only through bounded registration.
- LuaScript
Manifest - Inert, serializable metadata. It cannot be deserialized into execution authority.
- LuaScript
Registry - Outcome
- Immutable, evidence-backed result of evaluating one planned action.
- Queued
Task Fence - Optimistic ownership fence for a queued task.
- Recovery
Summary - Resource
Accounting - Accounting for one resource dimension.
- Result
Aggregator - Bounded completion-receipt result store.
- Result
Limits - Hard limits for retained completion results and aggregate reads.
- RunAccounting
- Run-level resource accounting.
- RunOutcome
Record - A verifier outcome or unresolved observation projected into a run report.
- RunReport
- Complete transport-neutral report for one authorized run.
- RunReport
Input - Construction input for a validated
RunReport. - RunStep
Report - One attempted phase or semantic action.
- RunStop
Reason - Structured, bounded reason that ended a run.
- Scan
Finding - A raw observation returned by a bespoke historical
ScanPhase. - Scan
Task - Versioned task snapshot.
- State
Snapshot - Bounded coordinator state summary.
- Task
Lease - Exact logical lease fence for one worker generation and task attempt.
- Task
Queue - Cloneable task facade sharing the pool’s single state lock.
- Task
Spec - Fresh task admission data.
target_refis opaque; this module never opens it. - Transition
- A successful command result and the revision after it.
- Verification
Limits - Host-configurable resource envelope shared by legacy phases five to nine.
- Worker
Node - Coordinator-owned worker snapshot.
- Worker
Observation - Caller-supplied heartbeat and resource observation.
- Worker
Pool - Atomic worker/task coordinator. All clones share one revisioned state lock.
- Worker
Spec - Caller-provided worker admission record.
Enums§
- ApiSurface
Kind - API surface families represented by paired observations and hypotheses.
- ApiVisibility
Dimension - Dimension measured by a paired visibility comparison.
- ApiVisibility
Pair Kind - The two views compared by one atomic visibility observation.
- ApiVisibility
Result - Outcome of an already paired visibility comparison.
- Cancellation
Outcome - Completion
Outcome - Discovery
Form Method - Method semantics retained for one parser-tree-descendant HTML form.
- Distributed
Error - Typed state-machine failures. Every failure leaves state unchanged.
- Event
Severity - Event severity levels.
- Event
Type - Event types in the scanning lifecycle.
- Evidence
Kind - Broad evidence category used for routing and policy.
- Evidence
Value - Typed value carried by evidence and claims.
- Failure
Outcome - LuaConfig
Violation - How one Lua configuration field violates its hard contract.
- LuaExecution
Error - LuaExecution
Status - LuaRegistration
Error - Fixed registration failure that never includes a path, source, or OS error.
- LuaRegistry
Error - LuaReturn
Value - Scalar value projected from a completed Lua invocation.
- Outcome
Error - Validation errors for verification outcome contracts.
- Outcome
Status - Final classification emitted by a verifier.
- Resource
Accounting Mode - Whether a resource dimension was enforced by a shared meter.
- RunReport
Error - Validation errors for typed run reports.
- RunStatus
- Overall completion state for one run.
- RunStep
Status - Completion state for one phase or semantic action.
- RunStop
Code - Stable classification for why a run stopped.
- Script
Category - Script categories used by inert registry metadata.
- Security
Severity - Typed severity attached to a projected outcome or unresolved observation.
- Start
Outcome - Store
Result Outcome - Idempotent result-store outcome.
- Task
Ownership - Exact logical cancellation fence for queued or leased work.
- Task
Priority - Task priority. Higher priorities are selected first.
- Task
Status - Exact task lifecycle state.
- Verification
Stage - Evidence collection stage that produced a verification outcome.
- Worker
Status - Worker eligibility state.
- Worker
Tag - Observational worker metadata tags. Ordering is stable and non-randomized; the coordinator does not use these tags for eligibility or affinity.
Constants§
- MAX_
ACTIVE_ TASKS - Absolute ceiling for active and queued tasks.
- MAX_
AGGREGATE_ ITEMS - Absolute ceiling for one aggregate request.
- MAX_
HEARTBEAT_ TIMEOUT_ SECS - Absolute ceiling for heartbeat timeout policy.
- MAX_
IDENTIFIER_ BYTES - Maximum task, scan, or worker identifier length in bytes.
- MAX_
LEASE_ TTL_ SECS - Absolute ceiling for a lease TTL.
- MAX_
RESULTS - Absolute ceiling for retained result records.
- MAX_
RESULT_ BYTES - Absolute ceiling for one result.
- MAX_
RETRIES - Absolute ceiling for configured retries after the first attempt.
- MAX_
RUN_ REPORT_ EVIDENCE_ IDS - Maximum evidence references retained by one projected outcome.
- MAX_
RUN_ REPORT_ OUTCOMES - Maximum outcome projections retained in one report.
- MAX_
RUN_ REPORT_ STEPS - Maximum steps retained in one report.
- MAX_
RUN_ REPORT_ TEXT_ BYTES - Maximum bytes retained in a single human-readable report field.
- MAX_
TARGET_ REF_ BYTES - Maximum opaque target reference length in bytes.
- MAX_
TASK_ PHASES - Maximum phases carried by one task.
- MAX_
TASK_ RECORDS - Absolute ceiling for retained task records and terminal reservations.
- MAX_
TASK_ TTL_ SECS - Absolute ceiling for task TTL policy.
- MAX_
TOTAL_ RESULT_ BYTES - Absolute ceiling for retained or aggregated result bytes.
- MAX_
WORKERS - Absolute ceiling for retained worker records.
- MAX_
WORKER_ CAPACITY - Absolute ceiling for one worker’s configured concurrency.
- MAX_
WORKER_ TAGS - Maximum observational worker metadata tags.
- RUN_
REPORT_ SCHEMA - Stable schema name for a typed Termivar run report.
- UTILIZATION_
BASIS_ POINTS - Integer utilization scale: 10,000 is 100%.