A deliberately vulnerable host exposes the most important limit of the library: one evaluation pass can map, compose and govern remediation, but it cannot truthfully certify a real website secure.
In 60 seconds
It does not “fix DVWA in one pass.” This pre-purchase run modifies zero host lines. What the library can add is a vulnerability-preserving defensive twin, security-regression matrix, replayable attack evidence, deploy-safety gates and a remediation-closure discipline. For a real vulnerable website, those capabilities reduce blind spots but still require direct code remediation and independent retesting.
Keep every intentional hacking lesson intact while running the same request through a defended comparison lane.
STIER-S-124 + STIER-S-IMM04 + STIER-S-122 → security.php + vulnerabilities/*/source/*.php
Prove both halves of the curriculum contract: vulnerable levels stay vulnerable as intended; impossible resists the expected class.
BLD-ENG-248 + BLD-ENG-256 + BLD-ENG-075 → tests/ + vulnerabilities/*/source/*.php
Refuse to call a real-world finding “closed” merely because code changed; require adversarial regression and then independent retest.
BLD-ENG-248 + STIER-S-CJ132 + BLD-ENG-075 → tests/ + CI
Turn a transient security exercise into tamper-evident, replayable evidence.
STIER-S-71 + STIER-S-90 → dvwa/includes/dvwaPage.inc.php
Turn DVWA’s deployment warning and safe defaults into executable assertions without breaking classroom mode.
BLD-ENG-075 + STIER-EXTRA-03 + BLD-PRM-068 → compose.yml + config/config.inc.php.dist
At least one card above is a Step 5A composite. Licence gate: EVALUATE ONLY — no CMPSBL purchase/grant record was supplied, so no implementation source may be copied or wired.
Step 0
Run before any file is copied. This host may be evaluated fully, but integration is blocked until the organisation has a valid CMPSBL Perpetual Edition purchase or grant record.
| Evaluation target | Supplied archive DVWA-master(1).zip, pinned by archive comment to commit 5d5c76cced604e54462b13723f5c69af58e78748. |
|---|---|
| Host licence (SPDX) | GPL-3.0-or-later |
| Where found | COPYING.txt and README.md:19–34 |
| Purchase or grant record | None supplied with this run. |
| CMPSBL authoritative licence | CMPSBL Perpetual Edition License 1.0 — US$499 one time, perpetual, per company; no recurring fee or expiry. |
| Verdict | EVALUATE ONLY — complete Steps 1–8; copy/integrate zero CMPSBL implementation files. |
| Clause that drove it | AGENTS.md Step 0: no purchase/grant record permits evaluation but blocks integration. |
| Scope limits | Catalog metadata may be evaluated; Discovery source is absent pre-purchase; PHP bridge output cannot be generated from this kit; no implementation/verification claims beyond catalog metadata. |
| Runner condition | run-agent-kit.mjs was not invoked. The evaluating agent performed the procedure manually, as instructed by the user. |
Sub-package note: the API lesson has its own Composer dependency graph under vulnerabilities/api/, but the repository root GPL licence remains the host licence for this evaluation. A separate nonprofit twin, if granted by the licensor, is outside and does not alter the paying host’s licence or this cost model.
Verdict
Excellent for a defensive-twin and remediation-closure build; invalid as a “one pass and the site is fixed” promise.
DVWA is a deliberately adversarial test because 57 low/medium/high module-level combinations are supposed to remain vulnerable. The library therefore succeeds only if it can add defense, evidence and verification without erasing the lesson. It can. But it does not replace direct PHP remediation, SAST/DAST, dependency review, manual penetration testing, or independent retest. On a real vulnerable site, the honest workflow is iterative: evaluate → remediate/integrate → internally regress → independently retest → repeat until the defined scope closes.
Step 5A — the section that sells
These are intentionally designed around DVWA’s unusual product contract: some vulnerabilities are not bugs to remove. The composites add a defended lane, security regressions, evidence and closure semantics without rewriting the vulnerable curriculum.
Mirrors an exercise request into a defended comparison lane, applies sanitization only to that lane, and uses an explicit lesson-integrity policy so intentional vulnerable behavior is preserved in the training lane.
| Composition | CMPSBL STIER-S-124 “Shadow Run Environment” + STIER-S-IMM04 “Autoimmune Prevention Governor” + STIER-S-122 “Input Sanitization Gateway” + host security.php and vulnerabilities/*/source/{low,medium,high,impossible}.php |
|---|---|
| Problem it removes | A generic security layer would erase the very vulnerabilities DVWA exists to teach. The host explicitly declares low/medium/high intentionally flawed while impossible is the secure comparison. |
| Runtime behaviour | Mirrors an exercise request into a defended comparison lane, applies sanitization only to that lane, and uses an explicit lesson-integrity policy so intentional vulnerable behavior is preserved in the training lane. |
| New because | No individual catalog row knows which vulnerabilities are product content; no DVWA module provides a shadow defended execution with false-positive suppression. |
| Attachment point | security.php; dvwa/includes/dvwaPage.inc.php; vulnerabilities/*/source/*.php |
| Leaves untouched | The original low/medium/high lesson code and expected exploitability. |
| Effort | 8–15 engineer-days, basis = three direct components + PHP bridge validation + 19-module policy matrix. |
| Verified (weakest ingredient, verbatim) | C:ok I:ok B:load T:— S:scan. Expanded: any T:— is Not claimed; any B:— is Not claimed. |
request
|
+--> training lane (original DVWA level; unchanged)
|
+--> shadow lane -> sanitize -> execute defended comparator
|
lesson-integrity policy
|
compare + record deltaGenerates controlled hostile inputs, classifies them, runs level-specific contracts, and audits drift in the expected vulnerable-versus-secure matrix.
| Composition | CMPSBL BLD-ENG-248 “Adversarial Input Generator” + BLD-ENG-256 “Schema Validator” + BLD-ENG-075 “Self-Audit Loop” + host 19 vulnerability families and impossible variants |
|---|---|
| Problem it removes | tests/test_url.py proves URLs respond, but it does not prove low/medium/high remain intentionally vulnerable or that impossible resists the expected attack classes. |
| Runtime behaviour | Generates controlled hostile inputs, classifies them, runs level-specific contracts, and audits drift in the expected vulnerable-versus-secure matrix. |
| New because | It tests both sides of DVWA’s product contract: “this route should be breakable here” and “the secure comparison should resist here.” |
| Attachment point | tests/test_url.py; vulnerabilities/*/source/*.php; security.php |
| Leaves untouched | Lesson implementation logic; tests observe and assert behavior rather than patching it. |
| Effort | 6–12 engineer-days, basis = 19 families × four levels, test adapters, and three <200-LOC direct components. |
| Verified (weakest ingredient, verbatim) | C:ok I:ok B:— T:— S:scan. Expanded: any T:— is Not claimed; any B:— is Not claimed. |
adversarial catalog -> generated cases -> level matrix
|
low / medium / high / impossible
|
schema classify + assertions
|
self-audit reportCaptures a bounded training/security episode into a hash-linked record and replays the event sequence for teaching, regression, or incident review.
| Composition | CMPSBL STIER-S-71 “Tamper-Evident Chain” + STIER-S-90 “Forensic Replay Engine” + host session/security-level/request metadata |
|---|---|
| Problem it removes | DVWA can demonstrate an exploit, but the repository has no native immutable episode chain that reconstructs exactly which lesson level, request sequence, and state transitions produced it. |
| Runtime behaviour | Captures a bounded training/security episode into a hash-linked record and replays the event sequence for teaching, regression, or incident review. |
| New because | The combination turns a transient exploit demonstration into a reproducible evidence artifact without modifying the lesson itself. |
| Attachment point | dvwa/includes/dvwaPage.inc.php; login.php; selected lesson request boundaries |
| Leaves untouched | Database semantics and vulnerability code; secrets must be redacted before evidence persistence. |
| Effort | 5–9 engineer-days, basis = two small direct components + request/session adapter + replay fixtures. |
| Verified (weakest ingredient, verbatim) | C:ok I:ok B:load T:— S:scan. Expanded: any T:— is Not claimed; any B:— is Not claimed. |
request/session facts -> event record -> hash chain -> replay session
|
deterministic timelineAudits startup/deploy invariants, refuses or alarms on unsafe public-facing configuration, rate-limits only the defended perimeter, and redacts operational logs while preserving explicitly marked teaching demonstrations.
| Composition | CMPSBL BLD-ENG-075 “Self-Audit Loop” + STIER-EXTRA-03 “Rate Limiter” + BLD-PRM-068 “Redact Secrets” + host compose.yml/config/config.inc.php.dist/.github/workflows/vulnerable.yml |
|---|---|
| Problem it removes | DVWA already warns against public exposure and binds Docker to loopback, but configuration can disable authentication and the CI lesson intentionally demonstrates secret exfiltration. A real deployment needs a guard that distinguishes lab mode from accidental exposure. |
| Runtime behaviour | Audits startup/deploy invariants, refuses or alarms on unsafe public-facing configuration, rate-limits only the defended perimeter, and redacts operational logs while preserving explicitly marked teaching demonstrations. |
| New because | It makes “safe to run as a lab” an executable deployment contract rather than a README warning alone. |
| Attachment point | compose.yml; config/config.inc.php.dist; .github/workflows/vulnerable.yml; deployment entrypoint |
| Leaves untouched | Explicitly enabled classroom examples, including the intentionally vulnerable workflow when run in isolated teaching mode. |
| Effort | 5–10 engineer-days, basis = three direct components + deployment-policy adapter + CI mode flag. |
| Verified (weakest ingredient, verbatim) | C:ok I:ok B:— T:— S:scan. Expanded: any T:— is Not claimed; any B:— is Not claimed. |
startup / CI / request perimeter -> policy facts
|
self-audit -> allow / refuse / warn
|
redact operational evidence
+-> rate-limit defended edgeMoves a finding from remediated to internally verified only after adversarial regression and policy checks pass; it then emits an explicit “external retest still required” state rather than declaring the site secure.
| Composition | CMPSBL BLD-ENG-248 “Adversarial Input Generator” + STIER-S-CJ132 “Adversarial Simulation Engine” + BLD-ENG-075 “Self-Audit Loop” + host tests and secure/impossible implementations |
|---|---|
| Problem it removes | A code change can look like a fix without proving the exploit path is closed or that adjacent behavior did not regress. |
| Runtime behaviour | Moves a finding from remediated to internally verified only after adversarial regression and policy checks pass; it then emits an explicit “external retest still required” state rather than declaring the site secure. |
| New because | It encodes the exact lesson this evaluation is testing: implementation is not closure, and internal retest is not independent assurance. |
| Attachment point | tests/; secure/impossible lesson variants; CI result handling |
| Leaves untouched | Independent DAST/penetration testing remains external work; the gate cannot manufacture third-party assurance. |
| Effort | 5–10 engineer-days, basis = two small adversarial components + self-audit + closure-state/test wiring. |
| Verified (weakest ingredient, verbatim) | C:ok I:ok B:— T:— S:scan. Expanded: any T:— is Not claimed; any B:— is Not claimed. |
finding -> code change -> adversarial regression -> self-audit
|
pass / fail
|
INTERNAL VERIFIED
|
independent retest
|
CLOSED| Composite | Ingredients | New behaviour | Effort |
|---|---|---|---|
| Vulnerability-Preserving Defensive Twin | CMPSBL STIER-S-124 “Shadow Run Environment” + STIER-S-IMM04 “Autoimmune Prevention Governor” + STIER-S-122 “Input Sanitization Gateway” | Mirrors an exercise request into a defended comparison lane, applies sanitization only to that lane, and uses an explicit lesson-integrity policy so intentional vulnerable behavior is preserved in the training lane. | 8–15 engineer-days, basis = three direct components + PHP bridge validation + 19-module policy matrix. |
| Security Regression Matrix | CMPSBL BLD-ENG-248 “Adversarial Input Generator” + BLD-ENG-256 “Schema Validator” + BLD-ENG-075 “Self-Audit Loop” | Generates controlled hostile inputs, classifies them, runs level-specific contracts, and audits drift in the expected vulnerable-versus-secure matrix. | 6–12 engineer-days, basis = 19 families × four levels, test adapters, and three <200-LOC direct components. |
| Exploit-to-Evidence Replay Capsule | CMPSBL STIER-S-71 “Tamper-Evident Chain” + STIER-S-90 “Forensic Replay Engine” | Captures a bounded training/security episode into a hash-linked record and replays the event sequence for teaching, regression, or incident review. | 5–9 engineer-days, basis = two small direct components + request/session adapter + replay fixtures. |
| Safe-Lab Exposure Lock | CMPSBL BLD-ENG-075 “Self-Audit Loop” + STIER-EXTRA-03 “Rate Limiter” + BLD-PRM-068 “Redact Secrets” | Audits startup/deploy invariants, refuses or alarms on unsafe public-facing configuration, rate-limits only the defended perimeter, and redacts operational logs while preserving explicitly marked teaching demonstrations. | 5–10 engineer-days, basis = three direct components + deployment-policy adapter + CI mode flag. |
| Remediation Closure Gate | CMPSBL BLD-ENG-248 “Adversarial Input Generator” + STIER-S-CJ132 “Adversarial Simulation Engine” + BLD-ENG-075 “Self-Audit Loop” | Moves a finding from remediated to internally verified only after adversarial regression and policy checks pass; it then emits an explicit “external retest still required” state rather than declaring the site secure. | 5–10 engineer-days, basis = two small adversarial components + self-audit + closure-state/test wiring. |
Build this composite first: Vulnerability-Preserving Defensive Twin. It establishes the boundary that prevents every later defensive control from accidentally “fixing” the training product itself.
A composite inherits the weakest verification claim of its ingredients. Every composite above includes at least one Not claimed test-coverage axis; PHP bridge behavior is also Not claimed until the host validates it.
Step 5B — new single-component designs
These are host-specific designs produced after the full catalog screen. They are proposals, not implemented code in this evaluate-only run.
A policy object that declares, per module and level, whether exploitability is required, tolerated, or forbidden. Every defensive control consults it before blocking a request.
| Built from | STIER-S-IMM04 Autoimmune Prevention Governor (FalsePositiveRecord, BlockDecision, AutoimmunePreventionGovernor) + BLD-ENG-075 Self-Audit Loop (registerPolicy, runAudit) |
|---|---|
| Plus host | security.php; vulnerabilities/*/source/*.php |
| New because | Normal security tooling treats a successful exploit as failure; DVWA needs a machine-readable exception model where some exploitability is the expected product behavior. |
| Unlocks | Safe CML hardening without accidentally turning DVWA into a non-training application. |
| Evidence path | Per-lesson policy receipt + regression report showing expected vulnerable and expected defended outcomes. |
| Effort | 3–6 engineer-days, basis = 19 lesson families × four-level policy table + adapters. |
| Constraints | Both catalog rows are direct with no ports. STIER-S-IMM04 Verified: C:ok I:ok B:load T:— S:scan (T = Not claimed). BLD-ENG-075 Verified: C:ok I:ok B:exec T:— S:scan (T = Not claimed). PHP bridge output is Not claimed until host validation. |
| Confidence | High — the host’s four-level security contract is explicit in security.php. |
module + level -> integrity contract -> block? observe? preserve?
|
audit receiptRuns the same controlled input against the intentionally vulnerable lane and its impossible comparison, then records the behavioral delta. It fails if a known weakness leaks into impossible or if an expected teaching weakness disappears from the lesson lane.
| Built from | STIER-S-124 Shadow Run Environment (createShadowRun, addAssertion, completeRun) + BLD-ENG-248 Adversarial Input Generator (generateAdversarialInputs) |
|---|---|
| Plus host | vulnerabilities/*/source/low.php ... impossible.php; security.php |
| New because | Neither the shadow runner nor fuzz generator knows DVWA’s paired pedagogical contract by itself. |
| Unlocks | A regression signal for the teaching curriculum and for secure-baseline quality at the same time. |
| Evidence path | Input case -> two outcomes -> assertion delta -> retained run record. |
| Effort | 4–8 engineer-days, basis = 19 modules, case normalization, and PHP execution adapters. |
| Constraints | STIER-S-124 Verified: C:ok I:ok B:load T:— S:scan (T = Not claimed). BLD-ENG-248 Verified: C:ok I:ok B:— T:— S:scan (B and T = Not claimed). No ports; PHP emitter still requires host validation. |
| Confidence | High on design; medium on implementation until PHP bridge and test harness are exercised. |
case -> vulnerable level ----\
> compare -> regression verdict
case -> impossible level -----/A stateful evidence record for each real vulnerability: detected, scoped, remediated, regression-tested, independently retested, and closed. A state transition carries evidence instead of being a checkbox.
| Built from | STIER-S-71 Tamper-Evident Chain (createAuditChain) + STIER-S-90 Forensic Replay Engine (AuditEvent, ReplaySession, ForensicReplayEngine) |
|---|---|
| Plus host | tests/test_url.py; CI workflows; remediation evidence produced by host team |
| New because | A replay engine alone reconstructs events; a hash chain alone proves integrity. The host-specific state model turns them into a security-closure control. |
| Unlocks | Honest customer language: “closed after independent retest,” not “we ran one tool once.” |
| Evidence path | Tamper-evident finding timeline with test/retest receipt references and replayable state changes. |
| Effort | 3–6 engineer-days, basis = small direct components + closure schema + CI adapters. |
| Constraints | STIER-S-71 Verified: C:ok I:ok B:exec T:— S:scan (T = Not claimed). STIER-S-90 Verified: C:ok I:ok B:load T:— S:scan (T = Not claimed). No ports. |
| Confidence | High — directly addresses the user’s one-pass-versus-closure question. |
DETECTED -> REMEDIATED -> REGRESSION PASS -> EXTERNAL RETEST -> CLOSED
\________________ tamper-evident evidence chain ______________/Evaluates deployment facts before serving: public bind, security level, authentication-disable state, and declared lab override. It can refuse production-like exposure and attach rate limits to a deliberately defended perimeter.
| Built from | BLD-ENG-075 Self-Audit Loop (registerPolicy, runAudit) + STIER-EXTRA-03 Rate Limiter (createRateLimiter) |
|---|---|
| Plus host | compose.yml; config/config.inc.php.dist; runtime startup configuration |
| New because | DVWA has warnings and safe defaults but no single runtime contract that turns those defaults into a refusal decision. |
| Unlocks | A safer classroom/demo distribution and a reusable pattern for real vulnerable web applications. |
| Evidence path | Startup audit report stating which exposure invariant passed or failed and why. |
| Effort | 2–5 engineer-days, basis = two direct components + four deployment assertions. |
| Constraints | BLD-ENG-075 Verified: C:ok I:ok B:exec T:— S:scan (T = Not claimed). STIER-EXTRA-03 Verified: C:ok I:ok B:load T:— S:scan (T = Not claimed). No ports. |
| Confidence | High for Docker path; medium for every alternate install path documented by DVWA. |
deployment facts -> policy audit -> safe? --yes--> serve
\--no---> refuse / explicit lab overrideDetects and redacts encoded or transformed secret material in normal CI output while honoring an explicit “teaching fixture” policy for DVWA’s intentionally vulnerable workflow.
| Built from | BLD-PRM-068 Redact Secrets (scrubText, redactSecrets, redactHeaders, redactUrl) + STIER-S-IMM04 Autoimmune Prevention Governor |
|---|---|
| Plus host | .github/workflows/vulnerable.yml; operational CI/logging paths |
| New because | A generic redactor would either break the lesson or leave normal pipelines exposed; the policy-aware pair can distinguish the two modes. |
| Unlocks | A demonstrable “unsafe lesson versus safe operations” CI boundary. |
| Evidence path | Redaction event plus policy decision showing whether the output was a permitted lab fixture or blocked operational leakage. |
| Effort | 2–5 engineer-days, basis = two direct components + CI mode signaling and test fixtures. |
| Constraints | BLD-PRM-068 Verified: C:ok I:ok B:— T:— S:scan (B and T = Not claimed). STIER-S-IMM04 Verified: C:ok I:ok B:load T:— S:scan (T = Not claimed). No ports. |
| Confidence | High that the host contains the need; medium on workflow integration until exercised. |
CI output -> secret detector -> policy context
|
teaching fixture?
/ \
allow redact + receiptBuild this one first: Lesson Integrity Contract. It turns “these vulnerabilities are intentional” from prose into an enforceable rule every later control can consult.
Scoreboard
The important number for this experiment is zero: in evaluate-only mode, one pass fixed zero host lines. The useful output is the map of what CML can harden, what still needs direct remediation, and how many verification loops are required before a real site can be called closed.
| Measure | Value | Basis |
|---|---|---|
| Engineered catalog rows parsed | 1,162 / 1,162 | Parsed from CATALOG-PHASE-3-COMPONENTS.md; zero rows omitted from class screening. |
| Engineered catalog classes covered | 21 / 21 | Every class from primitives/sub-primitives through engines, subsystems, packages, products, cognitives and layer packs was represented in the screen. |
| Rows matching a host concern | 482 | Broad capability/API/keyword triage after host inventory; a match is not a recommendation. |
| Candidate rows read in full | 40 | Full What/API/Entry LOC/Mode/Verified/Constraints read after triage; includes all 21 classes. |
| Engineered components carried forward | 11 | Direct components with a scoped DVWA attachment after twin/overlap/constraint rejection. |
| Composite components | 5 | Mandatory Step 5A combinations, each using exact IDs and host paths. |
| New host-specific designs | 5 | Step 5B single-purpose designs. |
| Discovery rows screened | 6,479 / 6,479 | Whole DISCOVERY-VAULT-INDEX.md screened as second pool. |
| Cyber vertical dedicated pass | 301 / 301 | Every row whose index keywords include cyber-v1 was separately screened before the general Discovery pool. |
| Provisional Discovery shortlist | 7 | Index-only rows; source absent pre-purchase; none included in money totals. |
| DVWA vulnerability families | 19 | Each family has low/medium/high/impossible level sources. |
| Intentional low/medium/high level combinations | 57 | 19 families × 3 deliberately vulnerable/challenge levels. |
| PHP syntax checks | 169 / 169 clean | php -l over every PHP file; syntax only, explicitly not security proof. |
| Host lines changed in this run | 0 | EVALUATE ONLY licence state; only the two required report files are added. |
| (A) cost avoided | US$0 | No evidence DVWA maintainers had already budgeted the proposed CML work. |
| (B) capability acquisition | US$24k–48k | 4–8 engineer-weeks at US$150/h if the team chose to build the defensive twin, evidence and closure system. |
| (C) portfolio reuse | US$0 | No other owner repositories/products are evidenced by this repository; no portfolio value invented. |
| Integration cost | US$18k–36k | 3–6 engineer-weeks for PHP bridge validation, wiring, security review and regression work. |
| Net, B-only counterfactual | −US$12,499 to +US$29,501 | B minus integration minus US$499 one-time licence; A and C remain separate at zero. |
| One-pass “fixed” claim | No | Evaluation did not modify or independently retest the application; closure requires subsequent remediation and independent retest loops. |
Step 1
Host inventory was completed before catalog matching. DVWA is not a normal vulnerable product: its vulnerability curriculum is intentional, its default security level is impossible, Docker binds to loopback, and it already contains secure comparison implementations, scans and isolation guidance. The actual gaps are regression, evidence, enforceable deployment policy and remediation closure.
| Host unit | Path | Exported surface | LOC | Job it does |
|---|---|---|---|---|
| Project intent & safety contract | README.md | Training purpose, intentional documented/undocumented vulnerabilities, isolation warning, GPL licence | 776 | Defines what must remain vulnerable and why Internet exposure is prohibited. |
| Security-level controller | security.php | low / medium / high / impossible selection; CSRF check | 89 | Selects intentional vulnerability level; impossible is the secure comparison lane. |
| Authentication entry | login.php | Login POST, CSRF check, MySQL lookup, session login | 137 | Shared/core login path; uses MD5 password hashing and string-built SQL. |
| Session / page / token core | dvwa/includes/dvwaPage.inc.php | dvwa_start_session, dvwaSecurityLevel*, checkToken, generateSessionToken, rendering | 692 | Shared session flags, security cookie, CSRF token lifecycle and page output. |
| Database bootstrap | dvwa/includes/DBMS/MySQL.php | schema creation and seed operations | 159 | Creates/reset lab database and seeded users/content. |
| Setup surface | setup.php | database reset/create flow with CSRF token | 171 | Re-initialises the lab; powerful state-reset path. |
| Configuration baseline | config/config.inc.php.dist | DB/env config, default security level, auth-disable switch | 56 | Defaults to impossible security; supports DISABLE_AUTHENTICATION override. |
| Container exposure | compose.yml | DVWA web + MariaDB services; 127.0.0.1:4280:80 | 39 | Already limits Docker web bind to loopback by default. |
| Container build | Dockerfile | php:8-apache base; composer:latest copy; build/install | 25 | Builds runtime; uses mutable image tags. |
| PHP runtime overrides | php.ini | allow_url_fopen=on; allow_url_include=on | 5 | Deliberately permissive runtime settings that support vulnerability lessons. |
| Vulnerability curriculum | vulnerabilities/*/source/*.php | 19 module families × low/medium/high/impossible; 89 PHP source files | 4,128 | The product content: exploit examples and secure/impossible comparisons. |
| API lesson dependency surface | vulnerabilities/api/composer.json + composer.lock | Swagger-PHP dependency graph, locked transitive packages | 454 | Third-party PHP dependency surface for API lesson. |
| URL smoke test | tests/test_url.py | URL list liveness/status checks | 124 | Functional reachability smoke test; not a security-regression suite. |
| Security scan workflow | .github/workflows/shiftleft-analysis.yml | ShiftLeft Scan -> SARIF upload | 35 | Existing external static/code scanning signal. |
| CodeQL workflow | .github/workflows/codeql-analysis.yml | CodeQL matrix: JavaScript + Python | 70 | Code scanning exists, but this workflow does not configure PHP. |
| Intentional insecure CI lesson | .github/workflows/vulnerable.yml | secret echo/base64 demonstration | 54 | Deliberately demonstrates secret exposure behavior; must not be silently “fixed.” |
Repository totals observed before any report file was added: 250 files; 169 PHP files; 12,940 PHP lines by physical line count. The 4,128 LOC figure above is the 89 PHP files under the 19 vulnerabilities/*/source lesson trees.
Step 2
All 1,162 engineered rows were parsed after the host inventory. 482 rows matched at least one broad DVWA concern during triage. 40 were then read in full across What/API/Entry LOC/Mode/Verified/Constraints, including at least one row from every one of the 21 catalog classes. The table below keeps rejects visible instead of silently dropping them.
| Candidate (ID) | Direct fit | Combinatorial | Value | Cost / risk | Novelty | Carried forward? |
|---|---|---|---|---|---|---|
| Shadow Run Environment ⚠twin of `BLD-ENG-050` (STIER-S-124) | High | High | High | Medium | High — defensive twin is not native | YES — COMBINE |
| Autoimmune Prevention Governor (STIER-S-IMM04) | High | High | High | Low–medium | High — crucial for intentional-vulnerability host | YES — COMBINE |
| Adversarial Input Generator (BLD-ENG-248) | High | High | High | Low | Medium | YES — HARDEN |
| Schema Validator (BLD-ENG-256) | High | High | High | Low–medium | Low | YES — HARDEN |
| Forensic Replay Engine (STIER-S-90) | High | High | High | Medium | High | YES — COMBINE |
| Tamper-Evident Chain ⚠twin of `BLD-ENG-009` (STIER-S-71) | High | High | High | Low | Medium | YES — COMBINE |
| Self-Audit Loop ⚠twin of `STIER-S-78` (BLD-ENG-075) | High | High | High | Low | Medium | YES — HARDEN |
| Redact Secrets (BLD-PRM-068) | High | Medium | High | Low | Low | YES — HARDEN |
| Rate Limiter ⚠twin of `BLD-ENG-012` (STIER-EXTRA-03) | Medium | Medium | Medium | Low–medium | Low | YES — HARDEN, defended lane only |
| Adversarial Simulation Engine (STIER-S-CJ132) | High | High | High | Medium | High | YES — COMBINE |
| Input Sanitization Gateway (STIER-S-122) | Medium | High | High | Medium | Low | YES — HARDEN, defended lane only |
| Defense Guardrail Kernel (BLD-ENG-294) | Medium | High | Medium | High — 1,307 closure LOC | Medium | NO — defer; too broad for first pass |
| Provenance Chain Verifier (BLD-ENG-229) | Medium | Medium | Medium | Low | Low | NO — evidence overlap with hash chain |
| Pipeline Lineage Registry (BLD-ENG-249) | Medium | Medium | Medium | Low | Low | NO — pipeline lineage is secondary here |
| Evolution Sandbox Environment (STIER-S-CJ116) | Medium | Medium | Medium | Low | Low | NO — Shadow Run is narrower fit |
| Artifact Hardening Foundry ⚠twin of `STIER-S-FRG03` (BLD-ENG-193) | Medium | Medium | Medium | Medium | Low | NO — hardening pipeline too generic |
| Rate-Limit, Origin & Secret-Leak Defense Layer (VPACK-CYBER-PERIMETER-SUITE) | High | High | High | High — layer/Ascension + PHP bridge | Medium | NO — defer layer; direct parts first |
| SANDBOX (PRIM-ENG-07) | Medium | Medium | Medium | Very high — 1,277 entry LOC + persistence port | Low | NO — DVWA already relies on container/VM isolation |
| Attack Surface Engine (SENGINE-ATTACK-SURFACE-ENGINE) | High | High | High | High — shared-entry + persistence port | Medium | NO — shared-entry row not costed |
| Threat Containment Engine (SENGINE-THREAT-CONTAINMENT-ENGINE) | High | High | High | High — shared-entry + persistence port | Medium | NO — shared-entry row not costed |
| auto-sentinel (PROD-AUTO-SENTINEL) | Medium | Medium | Medium | High — Node peer + product overlap | Medium | NO — competes with host workflow |
| dep-guardian (PROD-DEP-GUARDIAN) | Low | Low | Low | High — Node peer + separate product | Low | NO — dependency product is off-scope |
| @cmpsbl/shield (PKG-SHIELD) | Low | Low | Low | Medium | Low | NO — LLM prompt defense, wrong threat surface |
| Shield (SUBSYS-10) | Low | Low | Low | Medium | Low | NO — LLM Shield subsystem, wrong threat surface |
| Safe Patch Rollout Layer (VPACK-SENTINEL-EVOLUTION) | Low | Medium | Medium | High — Ascension-wrapped layer | Medium | NO — safe patch rollout is not first-order gap |
| Audit-Grade Decision Ledger ⚠twin of `BLD-ENG-136` (STIER-S-CJ94) | Medium | Low | Medium | Low | Low | NO — redundant with tamper chain + replay |
| Audit-Grade Decision Ledger ⚠twin of `STIER-S-CJ94` (BLD-ENG-136) | Medium | Low | Medium | Low | Low | NO — twin/overlap with audit ledger |
| Rate-Limit, Origin & Secret-Leak Defense Layer (LAYER-CYBER-PERIMETER-SUITE) | High | Medium | High | High — AscensionLayer cannot attach by import | Medium | NO — layer class requires Ascension |
| Error Shell (BLD-BLP-017) | Low | Low | Low | High — React peer | Low | NO — UI blueprint does not address security gaps |
| Panel Boundary (BLD-CMP-058) | Low | Low | Low | High — React peer | Low | NO — UI component irrelevant |
| Rate Limit Shield (BLD-FZN-023) | Medium | Low | Medium | High — React/motion peers | Low | NO — UI rate-limit shield wrong attachment |
| OBSIDIAN (COG-OBSIDIAN) | Low | Low | Low | Medium | Low | NO — cognitive capability unnecessary |
| Resilience Shield (MENGINE-RESILIENCE-SHIELD) | Medium | Medium | Medium | High — persistence port + broad engine | Low | NO — over-scoped |
| AUDIT (PRIM-AGE-03) | Medium | Medium | Medium | Very high — 27-project compile + persistence/zustand | Low | NO — full AUDIT agent excessive |
| DEFENSE (PRIM-LAY-01) | High | Medium | High | Very high — layer + persistence + Ascension | Medium | NO — direct components cover scoped need |
| IDENTITY (PRIM-ORG-07) | Low | Low | Medium | High — persistence + Node peer | Low | NO — host auth is simpler and lesson-specific |
| AEGIS (ENGINE-AEGIS) | Low | Low | Low | High — React host peers | Low | NO — store engine not a PHP security fit |
| BULKHEAD (SUBP-06) | Medium | Low | Medium | Low | Low | NO — generic bulkhead adds little to local lab |
| Shadow Mesh (SUBSYS-04) | Medium | Medium | Medium | Very high — 14-project compile + persistence/zustand | Medium | NO — Shadow Run provides smaller fit |
| @cmpsbl/test-harness (PKG-TEST-HARNESS) | Medium | Medium | Medium | Medium — TS harness in PHP host | Low | NO — targeted adversarial generator is narrower |
| Class | Rows parsed | Represented in full-read set |
|---|---|---|
| AscensionLayer | 45 | Yes |
| Block/Blueprint | 41 | Yes |
| Block/Component | 90 | Yes |
| Block/Engine | 314 | Yes |
| Block/Frozen | 59 | Yes |
| Block/Primitive | 90 | Yes |
| Cognitive | 5 | Yes |
| CrownJewel/S-Tier | 233 | Yes |
| CrownJewel/S-Tier-Unregistered | 13 | Yes |
| MetaEngine | 26 | Yes |
| Package | 13 | Yes |
| Primitive/Agent | 8 | Yes |
| Primitive/Engine | 8 | Yes |
| Primitive/Layer | 12 | Yes |
| Primitive/Organ | 12 | Yes |
| Product | 9 | Yes |
| StoreEngine | 55 | Yes |
| SubPrimitive | 8 | Yes |
| SubstrateEngine | 80 | Yes |
| Subsystem | 16 | Yes |
| VerticalLayerPack | 25 | Yes |
Candidates screened at row-parse level: 1,162; broad concern matches: 482; full-read set: 40; carried forward engineered components: 11; full-read rejects/deferred: 29. Shared-entry rows in the full-read set: SENGINE-ATTACK-SURFACE-ENGINE, SENGINE-THREAT-CONTAINMENT-ENGINE, LAYER-CYBER-PERIMETER-SUITE, COG-OBSIDIAN, MENGINE-RESILIENCE-SHIELD, ENGINE-AEGIS. They were not costed from shared Entry/Closure columns and were rejected/deferred rather than guessed.
Step 3
The most important constraint is semantic, not technical: hardening the vulnerable curriculum globally would be a regression. The second is technical: the host is PHP, and the kit’s PHP polyglot output is not among the build-checked target emitters.
| Constraint | Source of truth | What it rules out |
|---|---|---|
| Host is PHP/MariaDB, not TypeScript | Dockerfile; *.php; compose.yml | Requires licensed polyglot PHP bridge post-purchase. PHP emitter output is Not claimed until independently checked in this host. |
| Intentional vulnerabilities are product content | README.md:3–6; security.php:64–70 | Rules out global sanitization, global blocking, or “fix all low/medium/high” integration. |
| Internet exposure is explicitly unsafe | README.md:9–15 | Rules out treating CML as permission to publish DVWA publicly; isolation remains mandatory. |
| Docker already binds web to loopback | compose.yml | Rules out claiming the host has no perimeter control; new work must enforce/attest rather than duplicate. |
| Default level is impossible | config/config.inc.php.dist:30–33 | Rules out claiming secure-baseline mode is absent; focus on regression and shared/core gaps. |
| Authentication may be disabled by environment | config/config.inc.php.dist:40–43 | Requires deployment-policy gating if used outside a controlled lab. |
| Evaluation-only licence state | AGENTS.md Step 0; no purchase/grant record supplied | Rules out copying, generating, wiring or actuating CMPSBL implementation material in this run. |
| Layer classes require Ascension wrapping | AGENTS.md rule 12 | Rules out direct-import integration of AscensionLayer, Primitive/Layer and VerticalLayerPack candidates. |
| Discovery source absent pre-purchase | DISCOVERY-VAULT-INDEX.md only | Rules out Discovery API/LOC/verification claims and excludes Discovery from savings totals. |
| Independent test coverage is not claimed | Recommended catalog rows | Requires host-side security review and external retest before closure claims. |
STIER-S-124 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedSTIER-S-IMM04 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedBLD-ENG-248 C:ok I:ok B:— T:— S:scan — expanded: behavior = Not claimed; test coverage = Not claimedBLD-ENG-256 C:ok I:ok B:— T:— S:scan — expanded: behavior = Not claimed; test coverage = Not claimedSTIER-S-90 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedSTIER-S-71 C:ok I:ok B:exec T:— S:scan — expanded: test coverage = Not claimedBLD-ENG-075 C:ok I:ok B:exec T:— S:scan — expanded: test coverage = Not claimedBLD-PRM-068 C:ok I:ok B:— T:— S:scan — expanded: behavior = Not claimed; test coverage = Not claimedSTIER-EXTRA-03 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedSTIER-S-CJ132 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedSTIER-S-122 C:ok I:ok B:load T:— S:scan — expanded: test coverage = Not claimedGoverned runtime: none of the 11 carried-forward engineered components is marked governed-required; each catalog row is direct. Large governed/persistence-dependent primitives and engines were rejected or deferred. Layer-class rows remain non-importable by rule even when their row says direct.
Adapter ports: none on the carried-forward direct set. Separate post-purchase work remains: generate the PHP bridge using the licensed polyglot tool and validate it because PHP emitter behavior is Not claimed by this pre-purchase kit.
Step 4
Ranked for this deliberately vulnerable PHP application, not by catalog prestige. The first five are combinations; the individual parts follow. None is described as a complete vulnerability remediation engine.
| # | Item | Catalog IDs | Host paths | Effort | Value | Confidence |
|---|---|---|---|---|---|---|
| 1 | Vulnerability-Preserving Defensive Twin | STIER-S-124 + STIER-S-IMM04 + STIER-S-122 | security.php; vulnerabilities/*/source/*.php | 8–15 d | Very high | High on host gap; medium on PHP bridge |
| 2 | Security Regression Matrix | BLD-ENG-248 + BLD-ENG-256 + BLD-ENG-075 | tests/; vulnerabilities/*/source/*.php | 6–12 d | Very high | High |
| 3 | Remediation Closure Gate | BLD-ENG-248 + STIER-S-CJ132 + BLD-ENG-075 | tests/; CI workflows | 5–10 d | Very high | High concept; medium until DAST/retest connected |
| 4 | Exploit-to-Evidence Replay Capsule | STIER-S-71 + STIER-S-90 | dvwa/includes/dvwaPage.inc.php; lesson boundaries | 5–9 d | High | High |
| 5 | Safe-Lab Exposure Lock | BLD-ENG-075 + STIER-EXTRA-03 + BLD-PRM-068 | compose.yml; config/config.inc.php.dist; CI | 5–10 d | High | High on Docker; medium on alternate installs |
| 6 | Adversarial Input Generator | BLD-ENG-248 | tests/ + lesson inputs | 1–3 d | High | High |
| 7 | Schema Validator | BLD-ENG-256 | defended input contracts | 2–4 d | High | Medium-high |
| 8 | Forensic Replay Engine | STIER-S-90 | request/session evidence boundary | 2–4 d | Medium-high | Medium-high |
| 9 | Tamper-Evident Chain | STIER-S-71 | security evidence store | 1–3 d | Medium-high | High |
| 10 | Redact Secrets | BLD-PRM-068 | operational logs / non-teaching CI | 1–3 d | High | High on need; behavior Not claimed in catalog |
| 11 | Rate Limiter | STIER-EXTRA-03 | defended perimeter only | 2–4 d | Medium | High if public defended surface exists |
| 12 | Input Sanitization Gateway | STIER-S-122 | defended/impossible lane only | 2–4 d | High if bounded | Medium — globally applying it would be wrong |
| 13 | Adversarial Simulation Engine | STIER-S-CJ132 | internal security regression/closure gate | 2–4 d | Medium-high | Medium-high |
[HARDEN] CMPSBL STIER-S-124 "Shadow Run Environment ⚠twin of `BLD-ENG-050`" Why: Sandboxed execution environment for testing mutations, experiments, and risky operations before promoting to production. Provides full-fidelity simulation without any risk to live systems. Uses: `ShadowRun`, `ShadowAssertion`, `createShadowRun`, `startRun`, `addAssertion`, `addLog`, `completeRun`, `getRun`, `listRuns` Saves: ~6–12 engineer-hours, basis = 77 Entry LOC + isolated-run/assertion correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-S-IMM04 "Autoimmune Prevention Governor" Why: Prevents false-positive immune responses that would attack legitimate system operations. Teaches the defense system to distinguish friend from foe — preventing the substrate from fighting itself. Uses: `FalsePositiveRecord`, `BlockDecision`, `AutoimmunePreventionGovernor` Saves: ~1–3 engineer-days, basis = 130 Entry LOC + false-positive/allow/block correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL BLD-ENG-248 "Adversarial Input Generator" Why: Catalog-driven fuzzing inputs: injection, overflow, encoding, unicode edge cases. Uses: `ADVERSARIAL_CATALOG`, `generateAdversarialInputs` Saves: ~4–8 engineer-hours, basis = 33 Entry LOC + input-family/encoding correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:— T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL BLD-ENG-256 "Schema Validator" Why: Generic per-executor schema validation with archetype classification (XSS, SQL, event-handler injection). Uses: `FieldSchema`, `ExecutorSchema`, `ValidationIssue`, `InputArchetype`, `ValidationReport`, `SchemaRegistry`, `validateInput` Saves: ~1–3 engineer-days, basis = 174 Entry LOC + schema/classification/injection correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:— T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-S-90 "Forensic Replay Engine" Why: Complete system state replay from the audit trail for incident investigation. Reconstructs exactly what happened at any point in time — like a DVR for your entire infrastructure. Uses: `AuditEvent`, `ReplaySession`, `ReplayResult`, `ForensicReplayEngine` Saves: ~1–3 engineer-days, basis = 126 Entry LOC + event ordering/state replay correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-S-71 "Tamper-Evident Chain ⚠twin of `BLD-ENG-009`" Why: Hash-chained audit log with Merkle-tree batch verification. Every mutation is cryptographically linked to its predecessor — making tampering mathematically detectable. The foundation of trust in the substrate. Uses: `createAuditChain` Saves: ~4–8 engineer-hours, basis = 68 Entry LOC + hash-chain/Merkle correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:exec T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL BLD-ENG-075 "Self-Audit Loop ⚠twin of `STIER-S-78`" Why: Continuous self-audit loop with violation tracking. Uses: `AuditPolicy`, `AuditResult`, `AuditReport`, `registerPolicy`, `removePolicy`, `runAudit`, `getComplianceScore` Saves: ~4–8 engineer-hours, basis = 61 Entry LOC + policy-evaluation/compliance correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:exec T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL BLD-PRM-068 "Redact Secrets" Why: Deep-walks any value masking JWTs, API key prefixes, base64 blobs, UUIDs, sensitive headers, URL params, and error objects. Circular-ref + depth guarded. Drop into any logger. Uses: `scrubText`, `redactSecrets`, `redactHeaders`, `redactUrl`, `redactError`, `mightContainSecrets` Saves: ~2–4 engineer-days, basis = 182 Entry LOC + secret-shape/deep-walk/cycle/depth correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:— T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-EXTRA-03 "Rate Limiter ⚠twin of `BLD-ENG-012`" Why: Multi-strategy rate limiter: fixed window, sliding window, token bucket and leaky bucket, selectable per limiter. Per-key isolation, burst allowance, penalty escalation with a capped penalty level, and hit/reject analytics. Zero dependencies. Uses: `Strategy`, `RateLimitConfig`, `RateLimitResult`, `createRateLimiter` Saves: ~2–4 engineer-days, basis = 200 Entry LOC + multi-strategy/burst/penalty correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-S-CJ132 "Adversarial Simulation Engine" Why: Runs adversarial attack simulations against the substrate to identify vulnerabilities and harden defenses. Generates attack playbooks, measures defense effectiveness, and recommends improvements. Uses: `AttackScenario`, `SimulationResult`, `AdversarialSimulation` Saves: ~4–12 engineer-hours, basis = 57 Entry LOC + scenario/result correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
[HARDEN] CMPSBL STIER-S-122 "Input Sanitization Gateway" Why: Multi-layer input sanitization against injection attacks, XSS, and prompt manipulation. Validates, escapes, and transforms all inputs before they reach any processing pipeline — the first line of defense. Uses: `SanitizationResult`, `SanitizeOptions`, `ALLOWLISTS`, `sanitize`, `isSafe` Saves: ~1–3 engineer-days, basis = 170 Entry LOC + allowlist/escape/transform correctness concerns. This is equivalent component-build effort, not host integration effort. Verified: C:ok I:ok B:load T:— S:scan — T:— means Not claimed; any B:— means behavior is Not claimed. Mode: direct Ports to implement: none
| Gap | Evidence in host | What addresses it |
|---|---|---|
| No security-regression contract across all four lesson levels | tests/test_url.py checks reachability; security.php defines the four levels but no matrix asserts expected exploitability/resistance. | Security Regression Matrix + Secure-Baseline Differential Comparator |
| No immutable exploit episode replay | No native host unit records a hash-linked request/session/security-level timeline for replay. | Exploit-to-Evidence Replay Capsule |
| README safety warning is not a complete executable deployment policy | compose.yml is safely loopback-bound, but alternate installs exist and DISABLE_AUTHENTICATION can be enabled. | Safe-Lab Exposure Lock + Exposure Refusal Gate |
| One-pass remediation has no closure semantics | A passing code change or smoke test has no state requiring independent retest. | Remediation Closure Gate + Remediation Closure Ledger |
| Intentional insecure CI behavior can be confused with accidental operational leakage | .github/workflows/vulnerable.yml intentionally base64-prints secrets as a lesson. | CI Secret Exfiltration Tripwire with explicit teaching policy |
| Shared/core security issues are outside lesson-level sanitization | login.php uses MD5; CSRF token is md5(uniqid()); session Secure flag is false; some deployment settings are intentionally permissive. | Direct host remediation + regression/retest; CML can test/evidence but does not replace code fixes |
| Coverage cannot be certified complete from this evaluation | README states undocumented vulnerabilities are intentional; no DAST or independent pen test was run. | Multi-pass process; independent SAST/DAST/manual retest after remediation |
Low effort, high confidence, nothing on a critical path.
Items that would duplicate, undermine or dilute systems already trusted here.
Step 6
For this repository, the money answer is intentionally conservative. There is no evidence the maintainers planned the proposed CML work, and there is no evidence in this repo of another owner product to reuse it in, so (A) and (C) are zero. Only the counterfactual value of the new defensive-twin/closure capability is priced.
| Bucket | Engineer-weeks | US$ (range) | Basis and assumptions |
|---|---|---|---|
| (A) Cost avoided — work already planned | 0 | US$0 | No roadmap/budget evidence in the supplied repo showing this work was inevitable. |
| (B) Capability acquisition — would probably not have been built | 4–8 | US$24k–48k | Equivalent engineering for the defensive twin, regression matrix, replay evidence and closure state if the team decided it wanted them. Based on small direct Entry LOC rows plus multiple correctness concerns and 19×4 host behavior matrix. |
| (C) Portfolio and future reuse — conditional | 0 | US$0 | No other owner repository/product can be established from this host alone; no portfolio value invented. |
| − Integration cost | 3–6 | US$18k–36k | PHP bridge generation/validation, host wiring, test fixtures, security review, CI work, lesson-integrity policy and learning cost. PHP bridge verification is Not claimed until performed here. |
| = Net against US$499 one-time licence | −2.1 to +4.9 | −US$12,499 to +US$29,501 | B minus integration minus licence. A and C remain separate at zero. This is not revenue. |
One senior US application-security/full-stack engineer at US$150/hour, 40 hours/week. Estimate bands follow the kit’s Entry-LOC guidance but add host-specific PHP bridge, policy, regression and security-review work. The low side can be too optimistic if PHP bridge semantics need adaptation; the high side can be too pessimistic if the host adopts only the first two composites.
The strongest counterfactual is not a sanitizer or rate limiter. It is the vulnerability-preserving defensive twin plus a closure ledger: a system that can intentionally keep a lesson breakable while simultaneously proving what a defended execution would have done, and that refuses to equate “patched” with “closed.”
Conditionally yes. US$499 is small relative to even a few engineer-hours, but the licence price is not the deciding cost. The deciding cost is integration and validation. For plain DVWA training, do not buy it just to “secure DVWA.” For a cyber-range/teaching product or a real vulnerable web application that needs repeatable remediation evidence, the first two composites can justify the experiment.
What would change this answer: a verified PHP bridge, a demonstrated DAST/penetration-test connector, or evidence that the team already planned a comparable defensive twin would raise confidence/value; conversely, if the host must stay a tiny disposable lab with no defended mode, value drops sharply.
Step 7
| Phase | What ships | Why here | Gate to proceed | Effort | Cumulative |
|---|---|---|---|---|---|
| 0–30 days | Lesson Integrity Contract; baseline 19×4 Security Regression Matrix; Exposure Refusal Gate; PHP bridge proof on noncritical test path. | Establish what must remain vulnerable before any blocker can touch traffic. | STOP if any low/medium/high lesson unintentionally becomes non-exploitable, or any impossible case regresses. PHP bridge must pass host tests before broader wiring. | 2–4 engineer-weeks | 2–4 |
| 30–60 days | Vulnerability-Preserving Defensive Twin; Exploit-to-Evidence Replay Capsule; CI Secret Exfiltration Tripwire; direct PHP remediation of agreed shared/core issues. | Only after the lesson contract exists can defense be safely layered around the app. Direct code fixes happen separately from CMPSBL integration. | Every changed real vulnerability must have a regression case; teaching fixtures must remain deliberate; no secret-bearing evidence may persist unredacted. | 2–4 engineer-weeks | 4–8 |
| 60–90 days | Remediation Closure Gate/Ledger; independent SAST/DAST/manual penetration retest; residual fixes; repeat regression and retest until scoped findings close. | Security closure is an observed outcome, not a code-change event. | Do not claim “fixed” until an independent retest validates the defined scope. Any residual finding returns to remediation; there is no fixed maximum pass count. | 2–5 engineer-weeks + external test time | 6–13 + external |
Valid CML purchase/grant, full delivery, PHP polyglot bridge generation, host PHP test environment, explicit lesson-policy owner, and an independent security testing method/vendor for closure.
Do not start by globally installing Input Sanitization Gateway, full DEFENSE, SANDBOX, or a Cyber Vertical layer. On DVWA that can produce a false success by deleting the lesson instead of improving the security process.
Lesson Integrity Contract + Exposure Refusal Gate in days 0–30; Secure-Baseline Differential Comparator and CI Tripwire in days 30–60; Remediation Closure Ledger in days 60–90.
Build the Security Regression Matrix. It answers whether the host is still teaching what it should and whether the secure comparison actually holds after every change.
Capacity assumption: one senior security/full-stack engineer plus periodic maintainer review; independent retest capacity is external to the CML integration estimate.
Discovery Vault — provisional, kept out of every total
All 6,479 Discovery rows were screened. Because DVWA is a cybersecurity training host, the cyber-v1 vertical received a separate full pass over all 301 rows before the general pool. Source does not ship pre-purchase, so these are not treated as engineered recommendations.
| Discovery id | Capability (index row) | Host concern it may touch | Status | What to read first post-purchase |
|---|---|---|---|---|
| vdisc-00e02d9b | Unified BULWARK-RECON Fabric — Weaves BULWARK and RECON capabilities into a single operational fabric for coordinated patch management and vulnerability enumeration. | Patch management + vulnerability enumeration for residual-finding loops. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-00e02d9b-unified-bulwark-recon-fabric.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-03cc0ff6 | CIPHER-Enhanced vulnerability enumeration Engine — Augments vulnerability enumeration capabilities with CIPHER intelligence, while RECON ensures quality and consistency of outputs. | Vulnerability enumeration breadth beyond the engineered test inputs. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-03cc0ff6-cipher-enhanced-vulnerability-enumeration-engine.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-03036bae | BULWARK-Led Multi-Primitive incident response Engine — BULWARK orchestrates VANGUARD, WRAITH, and TEMPEST into a coordinated incident response workflow with real-time adaptation. | Incident-response orchestration if DVWA becomes a defended cyber-range. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-03036bae-bulwark-led-multi-primitive-incident-response-engine.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-07c3a07b | IRONCLAD-Led Multi-Primitive leak prevention Engine — IRONCLAD orchestrates OBSIDIAN, SPECTER, and CIPHER into a coordinated leak prevention workflow with real-time adaptation. | Secret/leak prevention around CI and evidence capture. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-07c3a07b-ironclad-led-multi-primitive-leak-prevention-engine.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-083a1403 | WATCHTOWER→VANGUARD→BULWARK Pipeline — WATCHTOWER feeds preprocessed signals to VANGUARD for analysis, then BULWARK applies the results — a fully automated containment strategies pipeline. | Containment workflow after a detected attack in a defended lane. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-083a1403-watchtower-vanguard-bulwark-pipeline.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-3a5194ad | VANGUARD-RECON Collaborative attack surface mapping Engine — VANGUARD and RECON collaborate with TRACER oversight to deliver automated attack surface mapping. | Attack-surface mapping for alternate install/deploy paths. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-3a5194ad-vanguard-recon-collaborative-attack-surface-mapping-engine.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
| vdisc-27c18a53 | VANGUARD→WRAITH→RECON Pipeline — VANGUARD feeds preprocessed signals to WRAITH for analysis, then RECON applies the results — a fully automated penetration testing pipeline. | Post-remediation penetration-test workflow; useful only after source review. | PROVISIONAL — index row only, source not read (pre-purchase) | Read vault/vdisc-27c18a53-vanguard-wraith-recon-pipeline.ts first; verify provenance header, actual API, side effects and host fit before any recommendation. |
No Discovery API surface, LOC, verification verdict or savings figure is stated. None of these rows is included in the Step 5 composites or Step 6 money totals until its source and provenance are read after purchase.
Step 8 — appended, never merged into the body
| Claim above / initial assumption | Re-check result | Estimate change |
|---|---|---|
| “DVWA has no deployment-safety controls.” | Incorrect. compose.yml binds the web service to 127.0.0.1:4280 and config defaults to impossible. README also explicitly forbids Internet-facing deployment. | Narrowed Safe-Lab Exposure Lock from “add isolation” to “enforce and attest existing safe defaults across alternate deployment paths.” |
| “DVWA has no security scanning.” | Incorrect. ShiftLeft Scan already runs and uploads SARIF; CodeQL also runs, but its matrix configures JavaScript and Python rather than PHP. | Removed any generic scanner recommendation; retained adversarial regression and closure evidence as the gap. |
| “Input Sanitization Gateway should be the first security fix.” | Rejected. Applying it globally would destroy low/medium/high lesson behavior, which is intentional product content. | Moved sanitization behind the Vulnerability-Preserving Defensive Twin and limited it to the defended/impossible lane. |
| “CMPSBL SANDBOX should replace host isolation.” | Rejected. DVWA already relies on VM/container isolation and Docker loopback binding; PRIM-ENG-07 is much heavier and requires PORT-PERSISTENCE. | PRIM-ENG-07 changed to SKIP; smaller Shadow Run remains for behavior comparison, not OS/container isolation. |
| “A successful CML pass can certify a vulnerable website fixed.” | Rejected. This run is EVALUATE ONLY, changed zero host lines, ran no DAST or penetration retest, and the kit’s own T axis is Not claimed for every recommended component. | The report now makes multi-pass closure a first-class result: evaluate -> remediate/integrate -> independent retest -> repeat until scoped findings close. |
| “The impossible level proves the whole application secure.” | Not established. The 19 impossible lesson variants are intended secure comparisons, but shared/core code still includes MD5 password hashing, string-built login SQL, md5(uniqid()) CSRF token generation, Secure=false session cookies, and intentionally permissive php.ini settings; undocumented vulnerabilities are explicitly part of DVWA. | No blanket secure-baseline claim. Core/shared code is a separate remediation track and needs independent validation. |
| “PHP integration can inherit the catalog’s TypeScript verification.” | Rejected. The full delivery supports polyglot bridge generation, but the kit states only TypeScript, Python and JavaScript emitters are build-checked; PHP output is Not claimed until host verification. | Integration estimate increased to include PHP bridge review, behavior tests and security review. |
| Initial repository inventory | Second pass reconfirmed 250 total files, 169 PHP files, 19 vulnerability families, all four standard levels present in every family, and PHP syntax lint 169/169 clean. | No inventory-count change; syntax cleanliness remains explicitly non-security evidence. |
| Kit licence wording | Authoritative AGENTS.md and LICENSING.md say one US$499 one-time perpetual licence. The shipped HTML template and portions of AGENT-HANDOFF-CATALOG.md still contain retired free/annual-door language. | Treated that wording as a kit documentation defect and kept the required purchase link while correcting the report to the authoritative current licence. |
| Runner execution status | Confirmed no call to run-agent-kit.mjs was made. Host inspection, catalog parsing, Discovery screening, scoring and report generation were performed manually by the evaluating agent. | No estimate change; this directly satisfies the run condition. |
Core learning result: Step 8 improves the evaluation, but it is not a substitute for a post-remediation security retest. The kit’s second inventory pass can catch evaluation mistakes and host overlap; it cannot prove that an implemented web application is free of vulnerabilities. For production security, remediation and independent verification must repeat until the agreed scope has no open findings or accepted risks.
Claim ceiling
Extracted from systems the author has run in production since August 2025. Operationally exercised, not independently security-audited.
In this pre-purchase evaluation, verification axes come verbatim from AGENT-HANDOFF-CATALOG.md. Every carried-forward component has test coverage: Not claimed in its compact verification string, and none has an independent third-party security review. S:scan is the library author’s static scan, not an independent audit. The host-side PHP lint result proves syntax only. No DVWA DAST, exploit retest or penetration test was run here.
Verification axes cited: C = compile/project check; I = integration closure check; B = behavior/load/execute evidence; T = test coverage, with T:— expanded as Not claimed; S = security scan/tests as catalogued. PHP polyglot bridge output is also Not claimed until validated in this host.
1,162 engineered components · 2,135 delivered source files · 446,551 delivered source lines. CMPSBL Perpetual Edition License 1.0: US$499 USD paid once, perpetual, per company; no recurring fee and no expiry. Offline delivery, no account, no telemetry. This report is evaluation, not a security warranty.