/attest

Adversarial Probing Catalog

Purpose: Read this when you need probe selection, category coverage, risk assignment, or the ADVERSARIAL_PROBES payload.

Contents

• Probe contract
• Risk classification
• Probe families
• Execution strategy
• Output format
• Quality rules

Probe Contract

Adversarial probing searches for what the specification forgot, contradicted, or left unsafe. Run it after extracting criteria and before issuing any final verdict.

Probe ID Convention

PRB-{category_code}-{NNN}

Category codes:
- BND = Boundary
- OMS = Omission
- CTR = Contradiction
- IMP = Implicit
- NEG = Negative
- CNC = Concurrency

Each probe must include:

• id
• category
• target_criterion or affected scope
• description
• spec_gap
• risk
• suggested_criterion
• implementation_status when implementation evidence exists

Risk Classification

Probe Families

Boundary (BND)

Use for limits, extremes, and threshold behavior.

Omission (OMS)

Use for behavior the spec forgot to mention.

Omission review prompts:

1. What happens when the feature fails?
2. What states can each entity enter?
3. What happens before and after the user action?
4. What happens if the dependency is unavailable?

Contradiction (CTR)

Use for conflicting requirements inside one spec or across related specs.

Contradiction review steps:

1. Group requirements by shared entity, workflow, or permission.
2. Compare action, timing, and state assumptions.
3. Flag any requirement that negates or weakens another.
4. Keep the probe open until the contradiction is clarified or resolved.

Implicit (IMP)

Use for hidden assumptions that implementations often depend on.

Assumption prompts:

1. Who is assumed to use this?
2. Where is it assumed to run?
3. When does ordering or timing matter?
4. How much volume or scale is assumed?
5. What breaks if the assumption is false?

Negative (NEG)

Use for forbidden, invalid, or unauthorized behavior.

Concurrency (CNC)

Use for race conditions, ordering, and parallel activity.

Execution Strategy

Priority Order

1. CTR because contradictions can invalidate the entire spec.
2. OMS because missing requirements become production defects.
3. NEG because validation and authorization gaps are high-risk.
4. BND because data limits often break integrity.
5. IMP because hidden assumptions create latent failures.
6. CNC because concurrency is narrower but expensive when missed.

Minimum Probes per Mode

Review Sequence

1. Map each probe to a criterion or spec section.
2. Verify the claimed gap against the actual spec text.
3. Assign risk based on business, security, and integrity impact.
4. Add a measurable suggested_criterion.
5. Feed open probes into the compliance report and remediation plan.

Output Format

Probe Template

PROBE:
  id: PRB-BND-001
  category: Boundary
  target_criterion: AC-XXX-001
  description: "Empty email input on login form"
  spec_says: "User submits email and password"
  spec_gap: "No specification for empty email handling"
  expected_behavior: "Validation error displayed"
  risk: MEDIUM
  suggested_criterion: "When email field is empty, display 'Email is required' error"

ADVERSARIAL_PROBES

ADVERSARIAL_PROBES:
  total: 18
  by_category:
    boundary: 4
    omission: 5
    contradiction: 1
    implicit: 3
    negative: 3
    concurrency: 2
  by_risk:
    critical: 1
    high: 4
    medium: 8
    low: 5
  probes:
    - id: PRB-OMS-003
      category: Omission
      target: AC-LOGIN-001
      description: "Login spec does not mention account lockout"
      spec_gap: "No lockout mechanism specified after failed attempts"
      risk: CRITICAL
      suggested_criterion: "After 5 failed login attempts, lock the account for 30 minutes"
      implementation_status: NOT_IMPLEMENTED

Quality Rules

• Do not keep a probe if the spec already addresses the concern.
• Do not invent a suggested criterion that is unrelated to the existing business intent.
• Treat unresolved CTR probes as release-blocking until clarified.
• Prefer one precise probe over several overlapping weak probes.
• Keep probes measurable so they can become criteria or tests immediately.

Categories + Minimums (SKILL.md excerpt)

Probe ID convention: PRB-{category_code}-{NNN}

Minimum Probes per Mode

Every probe output carries Probe ID, Category, Description, Spec Gap, Risk, Suggested Criterion.