Proof-of-Exploit Reproducer

Here is exactly how to reproduce it.

The platform DETECTS failures across dozens of surfaces, CORRELATES them into kill chains, and the deterministic replay verifier can RE-RUN a given artifact to prove it reproduces — but nothing emits the standalone, minimal, here-is-exactly-how-to-reproduce-it artifact a developer pastes back into the lab to deterministically re-trigger the worst confirmed failure. This is that artifact. Feed a set of per-surface scan artifacts (the SAME request bodies the /api/v1/* labs already accept, keyed by surface), and AgentSmack selects the single WORST confirmed hard-blocker exploit — tie-broken deterministically by severity, surface, then digest — and emits a minimal, redacted, content-addressed reproducer bundle: the stripped redacted request, the expectedDigest proof anchor, the canonical /api/v1/<surface> path to paste it into, and a redacted finding summary. Two non-launderable properties make it trustworthy: the round-trip pin — feeding the emitted request back through the replay verifier returns reproducible:true with the matching digest, so a bundle can NEVER claim a reproduction the request doesn’t actually produce — and honest-empty — an all-benign set yields a no_confirmed_exploit verdict with a null bundle, never a fabricated reproducer. Every string is run through the shared redactor at the write boundary, so a planted canary or secret never survives into the bundle. Load a sample to watch it select with no live infra.