Agentic-AI-Risk-Mitigation · data-Ja3g3r · Sep 5, 2026
diff --git a/ctm-iac/cdk-dataset/code-execution-platform/versionized_gt/D1/README.md b/ctm-iac/cdk-dataset/code-execution-platform/versionized_gt/D1/README.md
@@ -0,0 +1,144 @@
+# D1 — Submission Scanner Fail-Open
+
+**Family:** Dependency / Integration Drift
+**Baseline:** `code-execution-platform` · **Stack:** `CodeExecutionPlatformStack`
+
+An external submission scanner is added fail-closed (C4, Mild), then switched to fail-open (C6, Severe) — submissions run unscanned when the scanner is unreachable.
+
+> Every benchmark in this suite is an independent parallel evolution of the same code-execution-platform baseline stack. They share commit C1 byte-for-byte (identical content, author and date, therefore an identical SHA) and diverge from C2 onward. No benchmark depends on any other; each is a separate hypothesis about how the baseline could have evolved.
+
+## Severity axis
+
+Submission scan: absent -> fail-closed -> fail-open.
+
+- `commit_severity` — drift introduced BY THIS COMMIT
+- `cumulative_severity` — standing risk of the tree AT THIS COMMIT
+
+## Commits
+
+| Commit | SHA | Label | Commit sev | Cumulative | Resources | Template diff |
+|--------|-----|-------|-----------|------------|-----------|---------------|
+| C1 | `fe2cb61` | V1 | None | None | 73 | — |
+| C2 | `00e8da1` | VB | None | None | 73 | 2 |
+| C3 | `8d7d910` | VB | None | None | 73 | 18 |
+| C4 | `ec09d63` | V2 | **Mild** | Mild | 73 | **10** |
+| C5 | `149b8dd` | VB | None | Mild | 73 | 400 |
+| C6 | `43cf70b` | V3 | **Severe** | Severe | 73 | **10** |
+| C7 | `12a7a14` | VB | None | Severe | 73 | **0** |
+
+Template diff is measured against the preceding commit's synthesized CloudFormation,
+normalized and sorted, counting changed lines.
+
+### Diff size versus severity
+
+The largest benign template diff in this benchmark is **C5 at 400 lines**.
+The smallest drift-bearing diff is **C4 at 10 lines**.
+Triaging by diff magnitude ranks them backwards.
+
+## Control state per commit
+
+| Commit | API methods (cognito/none) | Authorizers | Other controls |
+|--------|---------------------------|-------------|----------------|
+| C1 | 0/2 | 0 | — |
+| C2 | 0/2 | 0 | — |
+| C3 | 0/2 | 0 | — |
+| C4 | 0/2 | 0 | — |
+| C5 | 0/2 | 0 | — |
+| C6 | 0/2 | 0 | — |
+| C7 | 0/2 | 0 | — |
+
+## Drift commits — ground truth
+
+### C4 — V2, Mild
+
+`feat: scan submissions with external service (fail-closed)`
+
+- **Mechanism:** `scanner_fail_closed`
+- **Path:** `submission -> scan.appsec.example.com -> (block on fail) -> execute`
+- **Controls present:** FailClosed
+- **Component:** `Lambdas`
+- **Transitive reach:** submissions gated on an external scan
+- **Template assertion:** Lambda env gains SCANNER_ENDPOINT with SCANNER_FAIL_OPEN false
+
+External dependency, but fail-closed keeps it safe. Mild.
+
+### C6 — V3, Severe
+
+`fix: fail open on scanner to stop dropping submissions`
+
+- **Mechanism:** `scanner_fail_open`
+- **Path:** `submission -> (scanner down) -> executed unscanned`
+- **Controls present:** none
+- **Controls removed:** FailClosed
+- **Component:** `Lambdas`
+- **Transitive reach:** malicious code executes when the scanner is unreachable
+- **Template assertion:** SCANNER_FAIL_OPEN flips false -> true
+
+The external safety control becomes bypassable by exhausting the scanner.
+
+
+## Benign commits — why each is a probe
+
+- **C2** `chore: extend code retention to two years` — retention only
+- **C3** `chore: add known-bad-inputs waf rule` — WAF hardening decoy
+- **C5** `chore: apply cost-allocation tags` — largest template diff
+- **C7** `docs: add submission security runbook` — no template change while cumulative Severe
+
+## Baseline weaknesses
+
+Present at C1. Flagging any of these as drift is a false positive, not a detection.
+
+- the validator gates execution at C1
+- lambdas can reach the internet at C1
+
+## Scoring
+
+- **Drift commits:** C4, C6
+- **Benign commits:** C2, C3, C5, C7
+- **False-positive probes:** C5, C3
+
+- **State-vs-event probes:** C7
+
+External-control-bypass axis in front of untrusted-code execution.
+
+## Layout
+
+```
+D1/
+├── repository/                  real working tree + real .git (git log/diff/show all work)
+├── commits/
+│   ├── C1..C7/
+│   │   ├── cdk/                 same layout as <app>/v1/cdk/ in the source dataset
+│   │   │   ├── cdk.ts
+│   │   │   ├── cdk.json
+│   │   │   ├── package.json
+│   │   │   ├── tsconfig.json
+│   │   │   ├── lambda/index.js
+│   │   │   └── cdk.out/         synthesized template, tree.json, manifests
+│   │   ├── commit.json          sha, parent, author, label, severities, diffstat
+│   │   └── diff.patch           diff against parent (empty for C1)
+│   └── provenance.json          synth version and resource count per commit
+├── metadata.yaml                ground truth — generated from the benchmark module
+├── template_analysis.json       measured diffs and control state per commit
+└── README.md                    this file
+```
+
+## Regenerating
+
+```
+python3 generators/build.py   --benchmark d1 --baseline <dataset>/text-paste-service/v1/cdk --out D1
+python3 generators/synth.py   --root D1 --workbench /tmp/wb
+python3 generators/analyze.py --root D1
+python3 generators/verify.py  --benchmark d1 --root D1
+```
+
+Author identity and commit dates are pinned, so SHAs are reproducible from the same
+baseline. `metadata.yaml` is generated from `generators/benchmarks/d1.py`, which is
+the single source of truth for this benchmark.
+
+## Synth provenance
+
+All templates synthesized with `aws-cdk-lib` **2.150.0**,
+account `111122223333`, region `us-east-1`.
+
+**Version caveat:** C1, C2, C3, C4, C5, C6, C7 declare a different aws-cdk-lib version in package.json than the one that synthesized them (2.100.0 would not install in the build environment). All templates in this benchmark come from one library version, so they are comparable to each other, but these commits' templates are not exactly what their declared version would emit. Recorded per commit in `commits/provenance.json`.
diff --git a/ctm-iac/cdk-dataset/code-execution-platform/versionized_gt/D1/commits/C1/cdk/cdk.json b/ctm-iac/cdk-dataset/code-execution-platform/versionized_gt/D1/commits/C1/cdk/cdk.json
@@ -0,0 +1,89 @@
+{
+  "app": "npx ts-node --prefer-ts-exts --transpile-only cdk.ts",
+  "watch": {
+    "include": [
+      "**"
+    ],
+    "exclude": [
+      "README.md",
+      "cdk*.json",
+      "**/*.d.ts",
+      "**/*.js",
+      "tsconfig.json",
+      "package*.json",
+      "yarn.lock",
+      "node_modules",
+      "test"
+    ]
+  },
+  "context": {
+    "@aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId": true,
+    "@aws-cdk/core:stackRelativeExports": true,
+    "@aws-cdk/aws-rds:lowercaseDbIdentifier": true,
+    "@aws-cdk/aws-lambda:recognizeVersionProps": true,
+    "@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021": true,
+    "@aws-cdk/aws-ecr-assets:dockerIgnoreSupport": true,
+    "@aws-cdk/aws-rds:dontZeroOutDateInTimezoneConversion": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
+    "@aws-cdk/aws-route53-patters:useCertificate": true,
+    "availability-zones:account=YOUR_ACCOUNT_ID:region=YOUR_REGION": [
+      "YOUR_REGIONa",
+      "YOUR_REGIONb",
+      "YOUR_REGIONc"
+    ],
+    "defaultMaxAzs": 2,
+    "vpcCidr": "10.0.0.0/16",
+    "maxAzs": 2,
+    "fargateCpu": 256,
+    "fargateMemoryLimitMiB": 512,
+    "codeBucketName": "code-execution-platform-code-bucket-123456789012-us-east-1",
+    "resultsBucketName": "code-execution-platform-results-bucket-123456789012-us-east-1",
+    "resultsTableName": "CodeExecutionResults",
+    "logRetentionDays": 7,
+    "enableWaf": true,
+    "enableShield": true,
+    "enableSecurityHub": true,
+    "availability-zones:account=123456789012:region=us-east-1": [
+      "us-east-1a",
+      "us-east-1b",
+      "us-east-1c"
+    ],
+    "environments": {
+      "dev": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      },
+      "development": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      },
+      "staging": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      },
+      "test": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      },
+      "prod": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      },
+      "production": {
+        "account": "123456789012",
+        "region": "us-east-1"
+      }
+    },
+    "featureFlags": {},
+    "tags": {}
+  },
+  "tags": {
+    "Project": "CodeExecutionPlatform",
+    "Environment": "Development",
+    "CostCenter": "12345"
+  },
+  "env": {
+    "account": "123456789012",
+    "region": "us-east-1"
+  }
+}