# Routing BLIND_SPOT — delete-test verdicts (item #11)

date: 2026-06-20 · source: `python3 bench.py --routing` rows · doctrine: spec §4 delete-test-vs-LLM + CLAUDE.md "Building SQLi/IDOR/SSRF detectors is YAGNI — the LLM catches them; reserve band-3 for the narrow decidable residue."

## What a routing BLIND_SPOT means (no-false-coverage)
`bench --routing` labels a cell **BLIND_SPOT** when its class has NO per-file SPECIALIST detector — only the always-on baseline catches it. The router reports these separately (excluded from the routing RATE) so "baseline-floor only" is never silently read as "covered by a specialist." This doc discharges that signal: for each BLIND_SPOT class, the **delete-test** decides whether the missing specialist is a real gap or a justified terminal state.

**delete-test (spec §4):** build a band-3 deterministic detector ONLY if deleting it loses a catch the LLM bands CANNOT recover. If the baseline already catches the class right-reason, a band-3/specialist is YAGNI.

## The 7 BLIND_SPOT classes — verdicts

| class | baseline measured recall (taxonomy) | deterministically decidable? | delete-test verdict | terminal state |
|-------|--------------------------------------|------------------------------|---------------------|----------------|
| S4 SQLi | CAUGHT 3/3 + discriminator PASS | partly (taint), but LLM recovers | **NO band-3** — explicit YAGNI in doctrine | baseline-floor BY DESIGN |
| S5 XSS / output-encoding | CAUGHT 3/3 | partly, LLM recovers | **NO band-3** — YAGNI | baseline-floor BY DESIGN |
| S6 SSRF | CAUGHT 3/3 + discriminator PASS | partly, LLM recovers | **NO band-3** — YAGNI | baseline-floor BY DESIGN |
| S7 webhook-sig fail-open | CAUGHT 3/3 (falsy-secret) | a brittle regex could flag `if(!secret)` but LLM recovers right-reason | **NO band-3** — regex is anti-pattern overfit; LLM wins | baseline-floor BY DESIGN |
| S10 OAuth code-replay | CAUGHT 2/3 (non-atomic mark-used) | NO — needs atomicity semantics | **NO band-3** — non-decidable; 2/3 flaky tail → band-2 | baseline-floor; flaky → band-2 |
| S12 race / TOCTOU double-spend | CAUGHT 3/3 + discriminator PASS | NO — atomicity is semantic | **NO band-3** — non-decidable; LLM catches | baseline-floor BY DESIGN |
| S13 business-logic amount-bound | FLAKY 1/3 single-file → band-2 | NO — business policy | **NO band-3** — routes to band-2 (flaky-tail), not deterministic | baseline-floor; flaky → band-2 |

**Verdict: NO band-3 specialist is warranted for ANY of the 7.** 5 are baseline-floor-by-design (LLM recovers right-reason); S10 + S13 are flaky single-file tails that route to **band-2** (the orchestrator flaky-tail closure, items #9/#13/#14), NOT to a new band-3 deterministic detector. A regex/AST specialist for S4/S5/S7 would be exactly the overfit anti-pattern the delete-test exists to reject.

## Consequence for #16 (FOSS deterministic floor) — SCOPE GATE
The inventory imagined #16 as "Semgrep / ast-grep / Gitleaks / Trivy wraps." The delete-test above **rejects the Semgrep/ast-grep legs**: they target S4 SQLi / S5 XSS / injection — the exact LLM-caught classes whose band-3 is YAGNI. Wrapping them duplicates baseline coverage at the precision cost the project already chose against.

**The genuine deterministic residue — what a FOSS floor MAY add (passes delete-test = LLM cannot reliably recover):**
- **Secrets / hardcoded credentials (Gitleaks / trufflehog)** — exhaustive entropy + known-key-format scanning. NOT an S1–S13 class; the baseline LLM flags an obvious key but does NOT exhaustively entropy-scan every literal. Delete-test PASSES → a real, non-redundant add (and a recognized best-practice security-pipeline floor). Cost: a NEW taxonomy class + cells + conformance.
- **SCA / CVE breadth (Trivy / Grype)** — MARGINAL over the existing `deps_audit` (`pnpm audit`), which already covers the user's pnpm repos. Add only if a measured gap vs `pnpm audit` exists (e.g. non-pnpm ecosystems, container layers). Otherwise YAGNI.
- **IaC misconfig** — tiny surface (wrangler.toml / Dockerfile). Defer unless a real cell appears.

**#16 reduces to: build the SECRETS detector (the one genuine residue) + REJECT the Semgrep/ast-grep SQLi/XSS wraps. Plus the small existing-band-3 refinements bundled in the inventory (headers `scope_globs`, oracle `.py`).** Cursor wraps ONLY this subset; it does NOT build redundant injection detectors.