worlddelta (Engine B) — design
Class:
design· Function axis:f0the diff ·f1the world vocabulary ·f2the tripwire battery ·f3the standing graph analyses. Strict: only the shape we run. The why is inworlddelta-reasoning.md; the 25-analysis catalog is inengine-b-analyses.md; the system view indesign.md.
f0 — the diff
Engine B (feature scip, heavy — 128 GB–1 TB RAM, off by default) diffs the behaviour of a whole dependency world between two snapshots. diff(from, to) runs the default_tripwires battery over the pair and folds their findings into a BehaviorDelta (scip.rs:383); diff_with takes an explicit tripwire set so the heavy site can plug extra analyses in. BehaviorDelta::decision (scip.rs:391) reduces its findings to a Decision, and verdict_from (scip.rs:412) builds the same core::Verdict Engine A emits — so a consumer reads one shape regardless of engine.
Reuse: worlddelta.uses = [core] only. It is persisted by warehouse (capture_world_snapshot), never the reverse.
f1 — the world vocabulary
A WorldSnapshot (scip.rs:295) is modgunn's own graph vocab — lifted from SCIP, not borrowed from nornir:
| type | file:symbol | is |
Symbol |
scip.rs:104 |
{ id, display, package, capabilities, is_entrypoint } |
CallEdge |
scip.rs:150 |
a call-graph edge from → to |
DepNode |
scip.rs:164 |
a resolved dep { ecosystem, name, version, verified } — plus the analysis-input fields the supply-chain/temporal analyses read: owners/maintainers (#6/#12/#13), release_epochs (#7/#25), embedding (#18), license_history (#19), key (#20) |
DepEdge |
scip.rs:271 |
a dep-graph edge |
VulnSink |
scip.rs:285 |
{ symbol, advisory, severity } — a CVE landing on a symbol |
Capability |
scip.rs:70 |
net/fs/proc/env/FFI/unsafe/rng/clock (label()) |
WorldSnapshot::reachable_from_entrypoints (multi-source BFS over calls from is_entrypoint symbols) and WorldSnapshot::symbol(id) back the analyses below.
f2 — the tripwire battery
Tripwire (scip.rs:1442) is { name(), evaluate(from, to) -> Vec<Finding> }. default_tripwires (scip.rs:2135) is the landed battery — the seven pairwise tripwires that run on every diff():
| # | tripwire | fires when | severity |
| 1 | CallGraphDeltaTripwire (scip.rs:1452) |
any call edge added/removed between snapshots | Info |
| 2 | CapabilityDriftTripwire (scip.rs:1478) |
a capability reachable from entrypoints in to but not from |
High |
| 5 | SinkNewlyReachableTripwire (scip.rs:1504) |
a vuln sink reachable in to but not from — the highest-signal event |
≥ High |
| 3 | FingerprintDriftTripwire (scip.rs:1533) |
a symbol's transitive closure changed while its version + public API did NOT (the silent 5th-level-dep signal) | High |
| 17 | ObfuscationTripwire (scip.rs:1585) |
a symbol's Shannon-entropy fingerprint spikes vs its prior version | High |
| 6 | MaintainerAnomalyTripwire (scip.rs:1700) |
a dep's owners set changes — disjoint → takeover, partial → Medium, maintainer-count collapse → Low |
≤ High |
| 20 | SbomDriftTripwire (scip.rs:1637) |
a component (DepNode::key) entered/left the world — entered-unverified → Low, else Info |
≤ Low |
Two further tripwires are declarative and rule-configured, plugged in at the heavy site via diff_with rather than firing by default:
| # | tripwire | fires when | severity |
| 21 | PolicyTripwire (scip.rs:1964) |
any [PolicyRule] in the set asserts false on the delta (NoCapabilityGrowth / NoNewNativeCode / NoUnverifiedDependencyAdded / ForbidEcosystem); default_policy() at scip.rs:1980 |
High |
| 22 | ThresholdTripwire (scip.rs:2121) |
any [ThresholdRule] numeric bound is crossed (UnverifiedCentralityOver / CapabilitySurfaceGrewBy / NewSymbolEntropyOver / FanInAtLeast) |
High |
SinkNewlyReachableTripwire set-diffs reachable_from_entrypoints across the pair; FingerprintDriftTripwire compares fingerprint(snap, id) for symbols with identical package + display. The full 25-analysis catalog (families, compute tiers, per-analysis symbols) is in engine-b-analyses.md — 25 / 25 landed.
f3 — the standing graph analyses
Beyond the pairwise tripwires, single-snapshot analyses feed Engine A precision and monitoring priority:
reachability_gated_vulns(snap)(scip.rs:432) — #4: only the vuln sinks call-reachable from entrypoints (kills ~90% of version-only false positives);unreachable_vulns(scip.rs:447) is the complement.capability_surface(snap)(scip.rs:464) — #2: the labeled-sink set reachable from entrypoints (theBTreeSet<Capability>).blast_radius(snap)(scip.rs:480) — #11: PageRank over the dep-graph →(node, score);blast_radius_findings(scip.rs:525) surfaces the top-k as findings.
The rest of the standing catalog is landed alongside these — the supply-chain/statistical/legal analyses (typosquat_findings, release_cadence_anomalies, bus_factor_findings, owner_cluster_findings, sink_chokepoints, diamond_conflicts, dep_fanin_outliers, embedding_novelty_findings, license_transition_findings, change_velocity_anomalies scip.rs:891), the honeytoken/canary detector (honeytoken_findings scip.rs:1806, #23), the beyond-catalog taint-path SAST (taint_path_findings scip.rs:1354), and the temporal two-point diff verb (warehouse::world_diff warehouse.rs:864 → WorldEdgeDiff, #24). See engine-b-analyses.md for the full map.
Surface
No CLI of its own yet — Engine B is driven in code and persisted through warehouse's capture_world_snapshot / record_behavior_delta_findings (gated scip+warehouse). 29 unit tests cover the vocabulary, diff, the tripwire battery and the standing analyses (scip.rs::tests).