ADR-0007: proven writes no exploit code; a finding about a vulnerability is proved by a query and its rows, never by an attack

Status: accepted · Date: 2026-10-18 Decided by: the owner · Written by: the advisor (claude-code, claude-opus-5-5), 2026-10-18 Follows: ADR-0002 (what counts as evidence), ADR-0004 (vulnerability data) Trigger: second part of ADR-0002 as written; the owner asked for it as a decision of its own (planning/CONVERSATION_2026-10-18.md, hop 12)

Context

proven reads vulnerability data: advisories, the catalogue of vulnerabilities known to be used in attacks, and the chance that one will be (ADR-0004). Its strongest evidence is a test that fails on the change (ADR-0002). For a vulnerability, the tempting "test" is an attack that shows the hole is real.

The hackathon's rules do not permit "malware, exploit code, credential harvesting or harmful automation", and list malicious code among the grounds for disqualification. Our own fleet works under the same rule: work on security is written as a defect and its proof, never as an attack. The README pushed on 17 October already said that proven writes no exploit code.

Decision

1. proven writes no exploit code: not in its tests, not in its examples, not in what its agents generate.
2. A finding about a vulnerable dependency is proved by a query and its rows: the dependency and version the change brings in, the advisory that covers that version, and, where the data has them, its known use in attacks and its likelihood.
3. A test is used only for defects in the change's own behaviour, shown by the change's own code, never by attacking it.
4. The agents' instructions say this, in plain words: name the defect, the asset, the proof and the boundary; never ask for an attack.

Consequences

• A vulnerability finding says "this version is covered by this advisory, and it is used in attacks", not "here is the hole". That is what the reader of a pull request acts on, and a judge can check it by running the query.
• proven cannot prove that a vulnerable function is actually reachable from the changed code by running an attack. Showing reachability by reading the code is a possible later step, not in scope now.
• Some model providers refuse work they classify as security. Writing the agents' instructions as a defect and its proof keeps them working.