Namespace Kuestenlogik.Bowire.Security

AttackJsonPathClause: Operator-bag for the BodyJsonPath leaf. Path selects values; one of Exists, EqualsValue, Matches, or AnyValueMatches specifies what counts as a match.

AttackPredicate: Predicate-tree node for the vulnerability-template DSL. Each instance is either a leaf (one of the response-property checks set on this node) or a composite (one of AllOf / AnyOf / Not set on this node).

AttackPredicateEvaluator: Stateless walker that evaluates an AttackPredicate against an AttackProbeResponse. Returns true when the predicate matches — i.e. when the target is vulnerable according to the template.

AttackProbeResponse: Captured response context that AttackPredicateEvaluator walks an AttackPredicate against. Transport-agnostic: the HTTP scanner populates Status from the HTTP status code; future gRPC / SignalR / WebSocket transports map their own status concepts onto the same integer (gRPC: 0..16 status codes, SignalR: 200 for invocation OK / specific code on hub error, …).

AttackVulnerability: Identifying + classification metadata for a vulnerability template. Attached to a BowireRecording via its Vulnerability field when the recording is being used as a security-test probe rather than as a mock-server fixture.

FuzzExecutor: Server-side runtime for the schema-aware fuzzer. Shared between the bowire fuzz CLI subcommand and the /api/security/fuzz HTTP endpoint that the workbench's right-click "Fuzz this field" menu calls into. Stateless; payload wordlists + per-category response heuristics live as static data so neither consumer pays for instance state.

FuzzExecutorRequest: Input bundle for RunAsync(FuzzExecutorRequest, CancellationToken).

FuzzFieldSpec: What the engine knows about a field, extracted from the schema.

JwtSecurityAnalyzer: Deterministic JWT security analysis (#105): decodes a token's header + payload and runs rule-based checks — alg=none, symmetric-HMAC crackability, missing / expired / long-lived exp, missing nbf, scope creep, audience binding, future iat, kid injection surface. No crypto, no network, no AI — the substance a tester would otherwise eyeball on jwt.io. An AI layer can narrate these; this is the ground truth it narrates.

OastInteractionClause: Inner clause of OastInteraction — which out-of-band callback counts as proof (#35 Phase 2f). An empty clause means "any callback at all", which is already the finding for most blind templates: the target contacting a host it was fed is the vulnerability, regardless of transport.

OrchestratedFinding: A finding produced against one endpoint, carrying its triage verdict once scored.

OwaspApiTop10Mapper: Deterministic OWASP API Security Top 10 (2023) mapping per method (#106): each of the ten entries gets a tri-state status (at-risk / maybe / n-a) and a concrete suggested probe, from rule-based signals on the method's path, verb, and request fields. This is the ground truth the AI panel refines — and the panel still works with no model connected.

ProbeInteraction: One out-of-band callback attributed to a probe — the target reached out to a host the probe planted in it, which is the evidence a blind finding rests on (blind SSRF / RCE / XXE leave nothing in the response itself).

SchemaMutator: Schema-aware mutation engine (#175). Given a field's declared type it produces targeted invalid inputs — the type-confusion, boundary, encoding, enum-bypass, and structural mutations a schema-blind fuzzer misses. Output is seeded (reproducible via --seed) and budgeted (capped per field so a scan doesn't explode); the same (spec, seed, budget) always yields the same mutation set.

SecurityReport: Structured security report (#107): findings grouped by severity + OWASP, plus a diff against a baseline run. ToMarkdown(string?) renders the deterministic markdown skeleton; an AI layer adds the executive-summary prose.

SecurityReportBuilder: Builds a SecurityReport from a scanner SARIF document (the bowire scan --out artifact), optionally diffed against a baseline SARIF. Deterministic — no AI, no network.

SecurityReportFinding: One finding lifted out of a SARIF run for the report.

SecurityScanOrchestrator: AI security scan orchestration (#104): the single control flow that composes the four primitives into a loop — threat-model → (per above-threshold endpoint) probe → triage → report. Deterministic; the AI/scanner work is injected via ISecurityScanSteps. This is the "story" the individual primitives couldn't tell on their own.

ISecurityScanProbeRunner: Seam that executes probes against one endpoint for the AI scan orchestration (#104). The scan engine (Kuestenlogik.Bowire.Security.Scanner) or the host registers an implementation; the AI orchestration adapter resolves it optionally, so the AI planning stages (threat-model → triage → report) work even when no live probe executor is wired (plan-only mode) — and the core / AI packages don't take a hard dependency on the scan engine.

ISecurityScanSteps: The step primitives the orchestrator chains — supplied by the caller so the control flow stays deterministic + testable while the real work (AI threat-model / probe execution / AI triage / AI report) is pluggable.

Sections