# 04-cleared-axes - The Anti-Tunnel-Vision Memory

This is Cyclops v2's **breadth memory**. Every time an axis is screened and does not yield a

[[../00-doctrine/SEVERITY-GATE|gate-family]] finding, it is logged here - *before* moving on (the

[[../00-doctrine/OPERATING-CORE#4-the-anti-drift-rule-log-cleared-axes-rotate-archetypes|anti-drift rule]]).

The log exists so the agent:

1. **Never re-screens the same (target, archetype, axis)** - no re-walking cleared ground.

2. **Can prove it covered breadth**, not just depth on one tunnel - the v1 failure.

3. **Has somewhere to put low/medium hardening notes** so they never leak into a finding report (the

   [[../00-doctrine/SEVERITY-GATE|gate]] forbids off-path reports; this is where those observations go).

An entry here is **not** a failure. A clean **DISPROVEN** is a completed unit of work

([[../00-doctrine/OPERATING-CORE#5-disproven-is-a-success|DISPROVEN is a success]]).

---

## Entry format

One row per cleared axis. Append-only. Use this exact schema (markdown table or one file per target -

table is fine to start).

| Field | Meaning |

|---|---|

| `date` | ISO date the axis was cleared (YYYY-MM-DD). |

| `target` | The software + **pinned version/commit** (novelty depends on the exact tree). |

| `archetype` | Which [[../01-archetypes/electron-desktop|archetype lens]] was applied. |

| `axis` | The specific kill-chain / sink / hypothesis screened (be precise - name the sink/route). |

| `result` | `DISPROVEN` \| `SOURCE_CONFIRMED-stalled` \| `SIBLING-CVE` \| `HARDENING-NOTE` \| `OUT-OF-SCOPE`. |

| `oracle` | What was driven and what it returned (e.g. "ASan fuzz 6h, only null-deref DoS"; "no artifact"). |

| `reason` | *Why* it cleared - the guard found, the missing control, why no gate-family path. |

| `revisit` | A condition that would reopen it (e.g. "if new GGUF KV type lands", "if auth is disabled"), or `none`. |

### Result-code meanings

- **DISPROVEN** - drove the oracle, the impact did not materialize. The strongest clear. Permanently

  retired unless `revisit` fires.

- **SOURCE_CONFIRMED-stalled** - a real source→sink path exists but the oracle couldn't be driven yet

  (couldn't build a replica, needs a primitive we don't have). Parked, not dead.

- **SIBLING-CVE** - the candidate matched an existing public CVE/advisory (per

  [[../06-methods/NOVELTY-DOCTRINE#the-sibling-cve-gate-novel-vs-variant-run-before-deep-work|the sibling gate]]).

  Record the CVE id so we never re-investigate it.

- **HARDENING-NOTE** - a real low/medium issue (IDOR, missing header, verbose error, exposed-but-empty

  service) that is **below the gate** and therefore **not a finding**. Lives here, never in a report.

- **OUT-OF-SCOPE** - authorization/scope ruled it out per

  [[../00-doctrine/OPERATING-CORE#1-authorization-the-only-place-cyclops-is-allowed-to-point|the charter]].

---

## Example entries

```

| date       | target                         | archetype          | axis                                                        | result                  | oracle                                              | reason                                                                 | revisit                              |

|------------|--------------------------------|--------------------|-------------------------------------------------------------|-------------------------|-----------------------------------------------------|------------------------------------------------------------------------|--------------------------------------|

| 2026-06-11 | llama.cpp @a1b2c3d              | ml-model-loaders   | gguf_init_from_file KV-array length → memcpy heap overflow  | DISPROVEN               | AFL++ 8h + ASan; 3 crashes, all null-deref DoS      | length validated against file size at gguf.c:412 before alloc          | if a new KV array type is added      |

| 2026-06-11 | Obsidian v1.x (asar)           | electron-desktop   | markdown render XSS → contextBridge → child_process         | DISPROVEN               | crafted note in disposable VM, no callback          | contextIsolation on; bridge exposes no fs/exec method                  | if a plugin widens the bridge        |

| 2026-06-11 | Flowise @e4f5g6h                | ai-agent-mcp       | /api/v1 unauth route → code node RCE                        | SIBLING-CVE             | replicated public auth-bypass                       | matches CVE-2024-xxxxx, already fixed upstream                          | none                                 |

| 2026-06-11 | Grafana v11.x                  | devops-infra       | datasource proxy SSRF → IMDS                                | HARDENING-NOTE          | SSRF callback fired, IMDS blocked                   | reaches outbound but metadata egress filtered; bare SSRF below gate     | if deployed without egress filtering |

```

---

## Usage rules

- **Append before you rotate.** You may not move to the next archetype until the cleared axes of the

  current one are logged. The rotation requirement is enforced by this log existing.

- **Check before you screen.** At the start of any (target, archetype) pass, read existing entries for

  that target - if the axis is already DISPROVEN/SIBLING and `revisit` hasn't fired, skip it.

- **Pin versions.** A clear is only valid for the pinned commit; new code reopens the surface (that's

  [[../06-methods/NOVELTY-DOCTRINE#lever-1-hunt-freshly-released-code-the-time-arbitrage|Lever 1]]).

- **Hardening notes die here.** Resist the pull to "at least report the IDOR." The gate says no; the

  log is where it goes.