docs: design CVE-to-invariant mining and executable witnesses

[PhysShell]

What changed

• adds docs/security-invariant-mine.md;
• places CVE/advisory ingestion, patch resolution, semantic-delta extraction, witness orchestration, evidence, and commercial policy in OwnAudit;
• keeps Own.NET package-independent and limits its role to qualified semantic predicates and reduced regression fixtures;
• defines applicability classes: dependency-only, consumer-analyzable, library-author-analyzable, configuration, and unknown;
• proposes the first invariant families: path/link containment, parser resource budgets, progress/cycle guarantees, and local IPC privilege boundaries;
• defines a bounded executable witness contract and static/dynamic correlation states (confirmed, static-only, runtime-only, inconclusive);
• adds vulnerable/fixed/reduced/negative qualification gates, provenance, replay, prior-art positioning, product boundaries, threat model, metrics, and a staged pilot;
• indexes the design in the root README.

Why OwnAudit

OwnAudit is already the evidence-heavy orchestration boundary and contains LeakFixMine, runtime correlation, artifacts, and the standalone audit direction. Own.NET should remain the pure SAST engine. Moving advisory feeds, checkout/build orchestration, generated witness execution, licensing, or billing into Own.NET would couple the analyzer core to a second product.

Positioning

This proposal is deliberately not framed as a new vulnerable-package scanner. Existing SCA products already report vulnerable dependency versions, and current products also provide forms of vulnerability reachability and runtime evidence. The narrower differentiator proposed here is the complete qualification chain:

CVE/fix patch
  -> package-independent invariant
  -> reusable Own.NET semantic predicate
  -> isolated vulnerable/fixed executable witness
  -> static/dynamic correlation
  -> replayable qualification record

The document treats novelty as an empirical claim to test against SCA reachability, SAST, IAST, patch-mining, and PoC-generation prior art rather than as marketing fact.

Safety boundary

The runtime artifact is called an executable witness, not an exploit generator. It is restricted to disposable isolation, no external targets, no ambient credentials, no network by default, unprivileged execution, strict resource limits, deterministic inputs, and vulnerable/fixed discrimination. Hosted execution requires a hardened VM-equivalent boundary; a container alone is not accepted as sufficient for arbitrary generated code.

Commercial boundary

The proposed split keeps the analyzer semantics open and makes the commercial OwnAudit value come from continuous curation, private-repository mining, hardened witness execution, proprietary calibration corpora, evidence management, enterprise integration, policy, and support. It explicitly rejects charging merely to repeat public CVE metadata or requiring a secret remote verdict for local diagnostics.

Validation

• branch is 2 commits ahead of main and 0 behind;
• changed files are limited to the new design document and README index;
• documentation-only change, so no code tests were run;
• repository layout and boundary were checked against the current OwnAudit plan and existing LeakFixMine design.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5aacf3b3-a578-4d57-8981-69229ea82c98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/security-invariant-mine

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}