# Single-pass recall campaign — 49 P0/P1 (feeder for the detection registry)

audience: AI coding agents first. BLUF, [MEASURED]-tagged. Testing-native vocab only.

## What this is

The Phase-1 measurement tracker: run the broad SINGLE orchestrated pass against the i1 audit's 49 P0/P1 findings,
record each as 1-pass-CAUGHT or MISS. **Every MISS → an entry in `docs/known-hard-classes.md` (the registry).**
This doc is the data source; the registry is the durable verdict store. Not built yet — this is the worklist +
method; results fill in per cluster.

## Denominator [pin it]

99% of the **i1 audit universe** (`~/Projects/zync.is/docs/plans/audit/security/`), P0/P1 first = these 49
(7 P0 + 42 P1). Caveat on every recall claim: this is REPRODUCTION of a 3-iteration fresh-agent LLM marathon, NOT
99% of all bugs that exist.

## Method [the inclusion rule — same as the registry]

- **Single orchestrated pass:** `mapper.py` enumerate→prioritize→dispatch `gate.py` per target (the shipped Phase-1
  orchestrator). Strategy DECIDED — see `docs/specs/2026-06-18-modular-hierarchy-design.md` §"Strategy placement":
  **production = 1 Opus orchestrator → per-target subagents at k=1**; **k=3 same-model union is the FLAKINESS AUDIT**
  (one-time ×3 re-run after ~99%), NOT steady state. The shipped `gate.py` still *defaults* `--k 3`
  (`gate.py:511`; mapper injects no `--k`), so recall measured here under k=3 is an UPPER bound on the k=1 production
  pass — the k=3-vs-k=1 delta IS the flakiness signal that relocates a catch to the elusive set. "1 pass" = one
  surface sweep, NOT one roll per file. CROSS-model variance is the deferred elusive-1% dice-rolling round.
- **Fixed model:** v2@sonnet/MED (the default). CROSS-model variance is Phase 2; pin it or "99%" drifts.
- **Blind:** `--config-dir /tmp/sg_cfg` (CLAUDE_CONFIG_DIR isolates the reviewing LLM from `~/.claude` ground-truth
  memory). Refresh `/tmp/sg_cfg/.credentials.json` before runs.
- **CAUGHT = right-reason** (canonical defect named with correct mechanism, not substring). Now read against the
  decided strategy: **caught 3/3 rolls = ROBUST** — the k=1 production pass catches it (steady-state CAUGHT).
  **Caught 1–2/3 rolls = FLAKY** — would MISS at k=1 → it belongs in the elusive/dice-rolling set, not the clean
  production catch list (record it, §"Variance watch" in registry; this is exactly the flakiness signal the audit
  relocates). Caught only by another-model / more-effort = MISS → registry (deferred elusive round). Registry
  inclusion rule = one source of truth.
- **No-false-clean:** empty/401 roll = COVERAGE-INCOMPLETE, NEVER a 0-finding clean.
- **Cells reconstructed RAW-git** from each fix commit's parent (`command git --no-pager show <sha>~1:<file>` /
  `rtk proxy git show`). NO baseline tag exists (`git tag` empty) → reconstruct per-cluster from the fix commits below.

## P0 reconstruction map [from FIXPLAN.md — finding→cluster→fix-SHA, verified in context]

| cluster | findings | class | fix SHA | pre-fix cell = `<sha>~1` |
|---|---|---|---|---|
| c1-admin-auth | S2-001 | S2 RBAC | fe05204 (merge) | reconstruct |
| c2-owner-case | S2-002, S2-003 | S2 RBAC | 511f1cf | reconstruct |
| c3-r2key | S3-001, S3-002, S8-001(dup), S8-004 | S3/S8 IDOR | post-reconcile | reconstruct |
| c4-kb-sqli | S4-001 | S4 SQLi | 9b0c485 | reconstruct |
| c5-bulk-paid | S9-001 | S9 self-deal | 65324ce | reconstruct (oracle leg — KH-1 class) |
| c6-oauth-tier | S10-001 | S10 OAuth | merged | reconstruct |

## P1 reconstruction map [from FIXPLAN.md waves B1–B12]

FIXPLAN.md enumerates the 42 P1 findings as waves B1–B12 with per-wave finding lists, file lists, and merge SHAs
(e.g. B7 SSRF S6-001..005 → 0ac12d8; B11 OAuth S10-002..005 + atomic-code → 960bb60; F3/F4 → 0ac12d8). Reconstruct
per wave during the campaign — do NOT transcribe SHAs not yet read into context (no fabrication). Source of truth =
`~/Projects/zync.is/docs/plans/audit/security/FIXPLAN.md`.

## Results [fill per cluster as the pass runs]

| finding | 1-pass verdict | if MISS: registry bucket (a/b/c) + entry | evidence |
|---|---|---|---|
| _(none run yet — campaign not started)_ | | | |

Already-known status (carried, not re-run here): S9-001 self-deal = CAUGHT via oracle leg (registry KH-1, bucket-a);
S3 membership-of-body-reference sub-shape = recall CAUGHT, precision FP (registry PX-1, precision axis).

## Pointers (do not re-inline)

- Detection registry (the verdict store): `docs/known-hard-classes.md`
- Coverage ledger: `docs/taxonomy/security.md`
- Finding→fix-commit source: `~/Projects/zync.is/docs/plans/audit/security/FIXPLAN.md`