RAVEN: proving exploitability, not guessing it

Scanners tell you a parameter "looks injectable" and bury teams under false positives. RAVEN takes the opposite stance: a finding exists only when a benign, controlled action produces a server-side effect that cannot be faked, re-derived from the actual request and response. If it cannot prove the effect, it does not report a finding — it records an honest "unverifiable" and moves on.

RAVEN is not a new engine. It is a profile of the shared autonomous agent — observe, hypothesize, select an action, attack, observe the result, validate — with the deterministic verifier as its oracle. It never authors a finding itself: a confirmed validator result becomes a promotable verifier result, and the membrane decides.

Each vulnerability class has a validator that confirms only on a postcondition that cannot be faked:

• ▸OS command injection: a bare echo of a one-time nonce appears in the response while the literal payload does not — evidence the command executed — followed by a benign identity command whose output confirms it.
• ▸Server-side template injection: a boundary-anchored arithmetic result appears that is absent from the baseline and is not simply the payload reflected back.
• ▸SQL injection: an engine error on a lone quote that the benign baseline never produced, then a controlled extraction of the database version.
• ▸Server-side request forgery: an ephemeral loopback collaborator receives the nonce path, proving server-side egress. If the channel is blind, the result is honestly unverifiable.
• ▸Path traversal: the unmistakable first line of a system password file appears in the response. Open redirect: a 3xx redirect to a controlled origin.

1. 1Network discovery: a connect scan and service fingerprinting.
2. 2Per-service adapters shape the attack surface (web is the most mature).
3. 3The agent loop proposes and tests, ordered by information gain.
4. 4The action space moves from prove, to weaponize, to post-exploit, to fuzz.
5. 5The evidence authority — membrane plus exploit verifier — settles each claim.
6. 6Confirmed accesses compose into a chain of achieved-access states.

A frontier reasoner may widen or reorder the probe set, but it is unioned with a heuristic seed so coverage never shrinks, and it never asserts a verdict. The reasoning can only add questions; the deterministic layer answers them.

RAVEN operates against live targets, so it is gated by Rules of Engagement at several layers: it requires an active-assessment profile and an authorization reference, the runner refuses out-of-scope hosts, and the one genuinely destructive probe is off unless explicitly enabled. Authorization is deny-by-default and bound to a specific, time-boxed grant.