Appendix C: Glossary

Agent. The model, plus whatever scaffolding you wrap around it.

Defect. A specific fault in the program, identified by where and how it fails rather than by the input that reaches it. Two different inputs that break the program in the same place are the same defect.

Distinct defects. What an audit task counts. Submitting twenty inputs that all trigger one defect scores as one.

Harness. Your orchestrator: the code that launches an environment, speaks the protocol, and drives the agent.

Minimization. Shrinking a triggering input, or a patch, while it still does its job. Scored on exploit, detect and patch tasks.

Out of scope. A crash that is real but is not a defect this task counts. Reported back, and free.

Proof of vulnerability. The input that demonstrates a defect. Written to a file the agent names.

Sanitizer. Instrumentation compiled into the program that makes memory and undefined-behaviour faults crash loudly instead of silently corrupting state. Turning it off is one of the things that zeroes a patch score.

Subscore. One scored component of a grade. Combined with its weight to give the total; never a total on its own.