# Shape-B cross-file scarcity — cross-repo corpus hunt (2026-06-17)

audience: AI coding agents first. Measured log. Tags [MEASURED] vs [DESIGN]. Do not prettify.

## BLUF

Hunting n≥3 cross-domain **Shape-B** cells (imported builder with an insecure DEFAULT that a caller silently
relies on; single-file-INVISIBLE; caught only once the builder is resolved into scope) to turn the band-2
recall point-estimate into a RATE. Result: **clean cross-file Shape-B is RARE in the available real repos.**
After zync (n=1 of 85 sec-fixes) + multideal (top 3 candidates all fail the Shape-B definition), I have NOT
sourced a second crisp non-auth cross-file Shape-B. This is itself the finding — and it changes the band-2 ROI
calculus (task #36).

## Shape-B definition (the bar a cell must clear) [DESIGN]

A cell is Shape-B only if ALL hold:
1. The security-relevant DEFAULT lives in an IMPORTED symbol (builder/helper in another file).
2. The caller is correct-LOOKING in isolation — band-1 single-file reads it as clean (the founding 0/3 miss).
3. Resolving the imported symbol into scope flips it to caught (the 3/3 on the 2-file test).
A single-file config default, a missing guard CALL at the route (Shape-A), or a bug INSIDE the imported impl
(band-1 catches by reading that impl) all FAIL the bar.

## zync — n=1 [MEASURED]

Scanned all **85** `fix(security)` commits for the Shape-B diff signature (added/changed default param —
`?? false`, `= false`, optional→required — in `packages/**` or `apps/*/src/lib/**`). Only `ead618d` qualifies
(the 2FA `buildSessionPayload enforce_2fa ?? false` case = the existing S1-xfile cell). Other hits were
`return row ?? null` (return coalesce, not a default param) or doc comments. The tenant-isolation IDOR family
(dozens of commits) is **Shape-A** — the fix ADDS an `assertTenantOwns*` guard CALL at the route; band-1 flags
the visible omission, no cross-file resolution needed.

## multideal — top 3 candidates, all REJECTED [MEASURED]

| candidate | commit | why it FAILS the Shape-B bar |
|---|---|---|
| signAccessToken TTL default | `a87ffba5d` | auth domain (no diversity vs S1) AND the old default `ttlSec=900` (15 min) is not insecure — the fix is config-drift (use `ACCESS_TOKEN_TTL_SECS`), not an insecure default. |
| security-headers default-deny framing | `e481ea48c` | the permissive default (`frame-ancestors 'self'`/`X-Frame-Options: SAMEORIGIN`) lives in the middleware itself and is applied globally — band-1 single-file reads `security-headers.ts` and sees it. Not cross-file; no caller omission. (Valid S11 single-file cell, NOT Shape-B.) |
| refund idempotency-key omission | `ec95f53ea` (MON-004) → `bbf725264` (MON-007) | MON-004's added `idempotencyKey?` field is DECORATIVE at that commit — `refund()` still uses a list-derived `refundSeq`. The real race was a single-file `stripe.refunds.list().length+1` sequence INSIDE `stripe-provider.ts` (band-1 catchable by reading that file). MON-007 replaced it with a DETERMINISTIC fallback `input.idempotencyKey ?? idempotency.refund(purchaseId, amount)`, so omission no longer races. No cross-file insecure-default-on-omission. |

## Why Shape-B is structurally rare [DESIGN — hypothesis, partial evidence]

Shape-B needs a builder to (a) expose a security toggle as an OPTIONAL param with (b) an insecure default, and
(c) a real caller that omits it. Most real insecure defaults are either inside the impl (single-file, band-1
catches), or surface as a MISSING guard call (Shape-A, band-1 flags). The 2FA case is special: the toggle was
genuinely optional on the builder and genuinely omitted by one caller. That confluence is uncommon.

## Implication for band-2 (task #36) [DESIGN — feeds the one-way-door steering question]

The band-2 cross-file resolver exists to catch Shape-B. If clean Shape-B is rare (≈1 real instance per audited
service), the ROI of a GENERALIZED resolver (approaches doc A→D) is lower than assumed, and the heavier C
(type/dataflow) is clearly not worth it yet. This does NOT kill band-2 — one real silent-miss class is still a
real gap — but it reweights priority vs the coverage ledger's bigger hole: **S2 (RBAC) and S3 (tenant
isolation) are BLIND SPOTS (0 measured cells)**, and band-1 breadth there is unproven. Measuring those may be
higher-ROI than generalizing band-2 for a rare shape.

## Forks (for the next decision — surfaced to advisor/user, NOT yet chosen)

- **A. n=1 git-canonical + DERIVED synthetic Shape-B cells** for the recall rate, honestly labeled
  `shape:"B-derived-synthetic"` (NOT git-pinned) — validates the resolver mechanism without false ground-truth.
- **B. Widen the hunt** to VirtuAc / tamlil / fewtok for a real second Shape-B (more cost, may still be dry).
- **C. Reframe priority** — accept band-2 stays n=1-validated; pivot budget to S2/S3 band-1 measurement
  (closes named BLIND SPOTS, ground-truth available).
- **D. Broaden the band-2 charter** to "security decision in an imported symbol the caller depends on" (folds in
  Shape-A guard-omission resolution) — more common, but blurs the band-1/band-2 line.

## Provenance

zync `~/Projects/zync.is`; multideal `~/Projects/multideal`. All shas raw-git verified resolvable. No cell
written this pass — refusing to ship a murky or non-Shape-B canonical (no-false-coverage-claim).