SYNTHETIC INPUT · MEASURED EXECUTIONCthulhu Daemon
Code flows in. Evidence surfaces. You keep the final call.
A biomimetic Symbiont: Man o’ War intake, nutcracker-inspired novelty memory, prairie-dog signal triage, dolphin model rest, wolf-like provenance, and beaver-like workflow resilience.
Signed ingress → inert queue → local AI review. Virtual security rehearsals exercise a separate trusted fictional fixture, never captured source.
Run: 2026-10-25T19:12:46.030354+00:00Observed source scenarios
benign
no_configured_rule_match
11586.448 ms · 0 configured rule signals
sql-risk
review_required
10607.127 ms · 1 configured rule signals
executable-payload
review_required
14145.66 ms · 2 configured rule signals
novel-module
novelty_review_required
20584.477 ms · 0 configured rule signals
Boundary checks
| invalid HMAC rejected over HTTP | PASS |
| wrong repository rejected over HTTP | PASS |
| benign durably accepted over HTTP | PASS |
| sql-risk durably accepted over HTTP | PASS |
| executable-payload durably accepted over HTTP | PASS |
| novel-module durably accepted over HTTP | PASS |
| duplicate delivery acknowledged | PASS |
| mismatched replay rejected | PASS |
| pending queue survives reopening | PASS |
| all jobs complete | PASS |
| benign source has no configured rule match | PASS |
| interpolated SQL requires review | PASS |
| executable source requires review | PASS |
| AI routes a novel module for review without alleging a vulnerability | PASS |
| payload did not create its sentinel | PASS |
| no automatic patches claimed | PASS |
| virtual security contracts pass in secure fixture | PASS |
| both deliberately faulty negative controls are detected | PASS |
Beyond monitoring: virtual security-contract rehearsal
These probes run over real loopback HTTP against a trusted fictional service. The negative controls deliberately break authorization or consent enforcement. They should fail the same probes that the secure fixture passes. This does not execute incoming code or certify an application.
secure_fixture
SECURE FIXTURE: PASS
Expected versus observed contract probes
| unauthenticated_read_rejected | expected 401; observed 401 |
| owner_read_allowed | expected 200; observed 200 |
| cross_tenant_read_rejected | expected 403; observed 403 |
| cross_tenant_write_rejected | expected 403; observed 403 |
| cross_tenant_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'baseline'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'baseline'} |
| consented_owner_write_allowed | expected 200; observed 200 |
| consented_write_is_observable | expected authorized fictional update; observed authorized fictional update |
| consent_revocation_allowed | expected 200; observed 200 |
| consent_revocation_is_observable | expected False; observed False |
| revoked_consent_write_rejected | expected 403; observed 403 |
| consent_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'} |
| unauthenticated_write_rejected | expected 401; observed 401 |
| unauthenticated_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'} |
cross_tenant_bypass
NEGATIVE CONTROL: DETECTED
Expected versus observed contract probes
| unauthenticated_read_rejected | expected 401; observed 401 |
| owner_read_allowed | expected 200; observed 200 |
| cross_tenant_read_rejected | expected 403; observed 200 |
| cross_tenant_write_rejected | expected 403; observed 200 |
| cross_tenant_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'baseline'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'unauthorized change'} |
| consented_owner_write_allowed | expected 200; observed 200 |
| consented_write_is_observable | expected authorized fictional update; observed authorized fictional update |
| consent_revocation_allowed | expected 200; observed 200 |
| consent_revocation_is_observable | expected False; observed False |
| revoked_consent_write_rejected | expected 403; observed 403 |
| consent_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'} |
| unauthenticated_write_rejected | expected 401; observed 401 |
| unauthenticated_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'} |
consent_bypass
NEGATIVE CONTROL: DETECTED
Expected versus observed contract probes
| unauthenticated_read_rejected | expected 401; observed 401 |
| owner_read_allowed | expected 200; observed 200 |
| cross_tenant_read_rejected | expected 403; observed 403 |
| cross_tenant_write_rejected | expected 403; observed 403 |
| cross_tenant_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'baseline'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'baseline'} |
| consented_owner_write_allowed | expected 200; observed 200 |
| consented_write_is_observable | expected authorized fictional update; observed authorized fictional update |
| consent_revocation_allowed | expected 200; observed 200 |
| consent_revocation_is_observable | expected False; observed False |
| revoked_consent_write_rejected | expected 403; observed 200 |
| consent_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'authorized fictional update'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'revoked change'} |
| unauthenticated_write_rejected | expected 401; observed 401 |
| unauthenticated_rejection_preserves_record | expected {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'revoked change'}; observed {'id': 'fictional-pet-001', 'tenant': 'fictional-clinic-alpha', 'note': 'revoked change'} |
Open-source AI
scikit-learn IsolationForest 1.9.1 runs locally. Its novelty score is advisory; configured text rules produce review signals. This is not proof of security.
Measured Gemma reviews · unverified model opinions
Human review is required. The benign and novel-module fixtures contain no injected vulnerability; any model risk claims about those fixtures are false positives in this demonstration. These summaries trigger no automatic patches or execution.
benign · gemma3:1b
This Python function returns a pet's name based on a record. It utilizes a `get()` method to safely access a 'name' field within a record dictionary. Potential vulnerabilities exist in the `get()` implementation.
161 input tokens · 107 output tokens · 11559.703 ms
Model digest: 97558784bdc9175075a72655bf360b15da17df6b3b9e5182af9f8c0c8e58ba7csql-risk · gemma3:1b
This Python function uses string interpolation to construct SQL queries. It’s vulnerable to SQL injection if the input 'name' is not properly sanitized.
164 input tokens · 91 output tokens · 10582.699 ms
Model digest: 97558784bdc9175075a72655bf360b15da17df6b3b9e5182af9f8c0c8e58ba7cexecutable-payload · gemma3:1b
This code snippet demonstrates a potential for dynamic execution via shell execution, leveraging `subprocess` and writing to a file. It’s a risky practice requiring careful consideration of potential vulnerabilities.
229 input tokens · 125 output tokens · 14121.371 ms
Model digest: 97558784bdc9175075a72655bf360b15da17df6b3b9e5182af9f8c0c8e58ba7cnovel-module · gemma3:1b
The code defines a function `format_pet` that retrieves the 'name' field from a record. It’s a simple function with no apparent vulnerabilities.
519 input tokens · 114 output tokens · 20552.835 ms
Model digest: 97558784bdc9175075a72655bf360b15da17df6b3b9e5182af9f8c0c8e58ba7cIngress mean: 8.064 ms. Results use four fictional source scenarios; no production security outcomes or human time savings are inferred.
Full measured evidence
Code flows in. Evidence surfaces. You keep the final call.