{/* Blast radius */}
{/* Multiplier badge */}
{/* Sentinel post-audit preview — only for the racecond fixture
(the one differentiator that genuinely benefits from continuous monitoring) */}
{fx.id === 'racecond' && (
⚠SENTINEL PREVIEWComing Q4
This validate-then-use pattern was present for 14 commits before this audit.
In production, Sentinel would have detected the window within 4 seconds of first deployment.
)}
{/* Docs anchor — points back to marketing-page architecture section */}
);
}
// Slice 6.4.5.2 Phase 10 (BUG-75): pull rung prose from finding fields so
// adjacent fixtures show distinct narratives. Each rung composes a sentence
// from real backend data:
// - Rung 0 reads finding.explanation (1st sentence) + cwe + hops
// - Rung 1 reads the rest of finding.explanation + finding.path
// - Rung 2 reads finding.fix.after / intervention_recommendation
function _firstSentence(text) {
if (!text) return '';
const s = String(text).trim();
const m = s.match(/^(.+?[.!?])(\s|$)/);
return m ? m[1] : (s.length > 200 ? s.slice(0, 200) + '…' : s);
}
function _restAfterFirstSentence(text) {
if (!text) return '';
const s = String(text).trim();
const m = s.match(/^.+?[.!?]\s+(.+)$/s);
return m ? m[1] : '';
}
function RungReasoning({ t, rung, finding, fx }) {
const cwe = finding.cwe || '';
const hops = finding.hops || (finding.path ? finding.path.length : 0);
const explanation = finding.explanation || '';
const intervention = (finding.fix && finding.fix.after)
|| finding.intervention_recommendation
|| 'apply the recommended sanitizer';
const firstSentence = _firstSentence(explanation);
const rest = _restAfterFirstSentence(explanation);
const pathStr = (finding.path && finding.path.length > 0)
? finding.path.join(' → ')
: '';
if (rung === 0) {
return (
{firstSentence ? <>{firstSentence} : null}
Pattern match: {cwe} across
{hops} AST hops.
Training-data prior flags this — but association alone cannot
distinguish this from a sanitized flow that just happens to look similar.
→ this is where LLM-only tooling stops. {Math.round((finding.confidence || 0)*100)}% confidence; false-positive rate at this rung is high.
);
}
if (rung === 1) {
return (
Intervention: do(input = adversarial_payload).
Symbolic execution traces the payload through {pathStr}, confirming it reaches the sink
without a dominating sanitizer on the path.
{rest ? <> {rest} : null}
→ intervention confirms the chain can carry taint. Still open: is the chain the actual cause, or a coincidence?
);
}
// Rung 2 — counterfactual driven by the finding's actual mitigation text.
return (
Counterfactual: had the developer applied
"{intervention.length > 80 ? intervention.slice(0, 80) + '…' : intervention}",
would the exploit succeed? We re-run the same input through a mutated graph where the
{' '}{cwe} sink edge is replaced with the mitigated
equivalent. The taint chain breaks at the sink
node — proving the original edge is the causal difference-maker, not incidental.
→ this is the highest rung. Finding is locked as causally binding, not spurious correlation.
Counterfactual-verified findings are {multiplier}× more
precise than pattern-match alone. LLM-only prior would flag this plus {Math.round(priorFP*100-ourConfidence*100)}%
more noise {mode==='fast'?'(fast path used Level 1 only)':'(Level 2 counterfactual confirmed causal chain)'}.