Architecture notes on autonomous security research
Written as we build Nexus and TCSF — evidence gates, research loops, attack graphs, and code-level proof. Not marketing copy.
-
2026-06-27architecture
Severity is a code decision, not a confidence score
How TCSF blocks High and Critical findings unless deterministic exploit proof exists — enforced in evidence_gate.py and impact_validator.py, not in a prompt.
-
2026-06-27benchmarks
Mythos Bar: what we measure and why
Official scoreboard for the power stack — critical precision, Web80 exploited, CVE-Bench mock chains, recall estimate, and multi-surface chain depth.
-
2026-06-14systems
From taint path to sandboxed indicator
Inter-procedural taint BFS, Semgrep/secrets/OSV discovery, and Docker-isolated PoC confirmation — code findings bridged into the EvidenceGraph.
-
2026-06-05methodology
Plan → execute → reflect: execution-grounded confirmation
ExploitConfirmationLoop plans probes, blocks destructive payloads, and verifies impact with hard oracles — not model confidence.
-
2026-05-28architecture
Five graphs, one intelligence representation
Evidence, Asset, Attack, Hypothesis, and Remediation — layered views over one EvidenceGraph. The moat is accumulated structure.
-
2026-05-20systems
Reasoning never sees raw stdout
Typed Evidence objects with content hashes and supports/contradicts relationships — LLM output is typed evidence, never a confirmed finding.
-
2026-05-12runtime
One investigation tick: TcsfKernel as the research runtime
TcsfKernel runs one full research tick — pipeline, evidence, reflect, experiment, learn, evaluate — with Nexus as the reasoning kernel inside.