Agentic Vulnerability Discovery Patch-Proof Replay is the public security-claim boundary for Microcosm. It checks projection protocol, vulnerability policy, synthetic target refs, issue hypotheses, trace evidence, abstract exploitability refs, patch diff refs, regression tests, verifier result records, sandbox verdicts, false-positive triage, cold replay, public agent-execution trace spans, secret-exclusion scan, nine copied source/control/standard/tool bodies, source-module manifest digests, metadata-only result record policy, and eight security-overclaim negative cases while keeping live targets, real CVE exploitation, weaponized payloads, account secrets, network exfiltration steps, actionable exploit instructions, model-output data, raw issue or patch bodies, benchmark claims, and source-file changes out of result records.
Contains 23 sections1 diagram6 references4 context groups
Scope limit Copied public source/control/standard/tool bodies, metadata-only synthetic patch-proof replay result records, public agent-execution trace spans, and fixture validation only; no live target testing, real CVE exploitation, weaponized payload export, account secret handling, network exfiltration, actionable exploit instructions, external model access, source-file changes, benchmark security score, launch-scope decision, publishing-scope decision, whole-system security claim, or product-progress evidence.
Covers Vulnerability Patch-Proof Replay