# 0010. Record Mythos-Era Vulnerability Storm Research And Doctrine Gaps

Status: Accepted  
Decision date: 2026-04-28  
Recorded date: 2026-04-28  
Retrospective: No

## Context

Public material from CSA, SANS, OWASP GenAI Security, and industry partners describes an **accelerated** shift: AI-assisted vulnerability discovery and exploit development compress **time-to-exploit**, widen the gap between **offense automation** and **defender patch pipelines**, and stress **supply chain** and **architecture** (blast radius) assumptions. Anthropic’s **Project Glasswing** and related red-team publications are cited in the ecosystem as exemplars, not as a mandate to adopt any single vendor.

The library needs a **durable, citable** place for **researched synthesis** and an explicit record of **what doctrine does not yet say**, so follow-up work can extend `principles/`, `patterns/`, and `checklists/` without pretending the gaps are already closed.

Evidence:

- Committed research note: [doctrine/evolution/mythos-era-engineering-principles-research-2026-04-28.md](../../doctrine/evolution/mythos-era-engineering-principles-research-2026-04-28.md) (sources and principle clusters; **not** normative library law).
- External anchors named in that note include NIST SP 800-218 (SSDF), SLSA, OWASP ASVS / Secure by Design, CSA Lab “AI Vulnerability Storm” / Mythos-ready briefing pages, and Anthropic’s published red-team material on Mythos Preview (URLs in the research note).

## Decision

1. **Adopt** the evolution note as the library’s **research basis** for “Mythos-era” / **AI vulnerability storm** framing: compressed disclosure-to-exploitation timelines, structural defender/offense asymmetry, and engineering-owned **VulnOps**-style capabilities.
2. **Do not**, in the **initial** change set (2026-04-28), promote the research memo’s principle clusters to **normative** `principles/` text without the usual layering review. A **follow-up** synthesis (same date) incorporated gap closure into principles/patterns per the table below.
3. **Record doctrine gaps** (below) as the **explicit backlog**—subsequently **closed in corpus** and indexed from this ADR for traceability.

## Open Doctrine Gaps (Backlog)

**Update 2026-04-28:** The following gaps were **closed in corpus text** by parallel research agents and a maintainer synthesis pass. Rows below are **historical** IDs; adopters should read the linked sections for normative intent.

| ID | Original gap | Closed in (section) |
| --- | --- | --- |
| G1 | Remediation SLOs / exploit-signal triage / SLIs | [secure-development-lifecycle.md](../../doctrine/principles/secure-development-lifecycle.md) §3; [dependencies-supply-chain.md](../../doctrine/principles/dependencies-supply-chain.md) §2; [measurement-and-dora.md](../../doctrine/principles/measurement-and-dora.md) §2.1 |
| G2 | Adversarial CI on merge path | [merge-path-evidence-and-pipeline-integrity.md](../../doctrine/principles/merge-path-evidence-and-pipeline-integrity.md) §2 invariants 8–9, §3; [testing-strategy.md](../../doctrine/principles/testing-strategy.md) §5; [tooling/merge-path-and-pipeline-control-suite.md](../../doctrine/tooling/merge-path-and-pipeline-control-suite.md) §1 |
| G3 | SBOM operational loop / promotion | [dependencies-supply-chain.md](../../doctrine/principles/dependencies-supply-chain.md) §3; merge-path invariant 9 |
| G4 | Blast-radius acceptance prompts | [threat-modeling-stride-lite.md](../../doctrine/principles/threat-modeling-stride-lite.md) §4 |
| G5 | AI-generated code on critical paths | [ai-ml-systems.md](../../doctrine/principles/ai-ml-systems.md) §4; [code-review-and-change-approval.md](../../doctrine/patterns/code-review-and-change-approval.md) §6 |
| G6 | Incident → architecture backlog | [incident-lifecycle-and-on-call-operations.md](../../doctrine/patterns/incident-lifecycle-and-on-call-operations.md) §9; secure-development-lifecycle §3 (root-cause class) |

## Consequences

- Discoverability: the research note appears under **Start Here** in [doctrine/README.md](../../doctrine/README.md) and in [REFERENCES.md](../../doctrine/REFERENCES.md) Internal Doctrine Map; glossary defines **VulnOps** for consistent use.
- **Consumer impact (after 2026-04-28):** adopters picking up this library version gain **normative** expectations on remediation measurement, adversarial merge-path gates, SBOM re-evaluation at promotion, blast-radius design prompts, agent-authored critical-path review, and post-incident architecture items—still subject to **estate** risk tiers and sector law.

## Related

- AI/ML governance baseline for the library: [0005](0005-treat-ai-ml-rag-and-agentic-workflows-as-first-class-governed-systems.md)
- Secure SDLC principle: [secure-development-lifecycle.md](../../doctrine/principles/secure-development-lifecycle.md)
