# worlddelta (Engine B) — design
> **Class:** `design` · **Function axis:** `f0` the diff · `f1` the world vocabulary · `f2` the
> tripwire battery · `f3` the standing graph analyses. Strict: only the shape we run. The *why*
> is in [`worlddelta-reasoning.md`](worlddelta-reasoning.md); the 25-analysis catalog is in
> [`engine-b-analyses.md`](engine-b-analyses.md); the system view in [`design.md`](design.md).
## f0 — the diff
Engine B (feature `scip`, heavy — 128 GB–1 TB RAM, off by default) diffs the **behaviour** of a
whole dependency world between two snapshots. [`diff(from, to)`](../src/scip.rs) runs the
[`default_tripwires`](../src/scip.rs) battery over the pair and folds their findings into a
[`BehaviorDelta`](../src/scip.rs) (`scip.rs:383`); [`diff_with`](../src/scip.rs) takes an
explicit tripwire set so the heavy site can plug extra analyses in.
[`BehaviorDelta::decision`](../src/scip.rs) (`scip.rs:391`) reduces its findings to a
`Decision`, and [`verdict_from`](../src/scip.rs) (`scip.rs:412`) builds the **same**
`core::Verdict` Engine A emits — so a consumer reads one shape regardless of engine.
**Reuse:** `worlddelta.uses = [core]` only. It is persisted by [`warehouse`](warehouse-design.md)
(`capture_world_snapshot`), never the reverse.
## f1 — the world vocabulary
A [`WorldSnapshot`](../src/scip.rs) (`scip.rs:295`) is modgunn's own graph vocab — lifted from
SCIP, not borrowed from nornir:
| type | file:symbol | is |
|---|---|---|
| `Symbol` | `scip.rs:104` | `{ id, display, package, capabilities, is_entrypoint }` |
| `CallEdge` | `scip.rs:150` | a call-graph edge `from → to` |
| `DepNode` | `scip.rs:164` | a resolved dep `{ ecosystem, name, version, verified }` — plus the analysis-input fields the supply-chain/temporal analyses read: `owners`/`maintainers` (#6/#12/#13), `release_epochs` (#7/#25), `embedding` (#18), `license_history` (#19), `key` (#20) |
| `DepEdge` | `scip.rs:271` | a dep-graph edge |
| `VulnSink` | `scip.rs:285` | `{ symbol, advisory, severity }` — a CVE landing on a symbol |
| `Capability` | `scip.rs:70` | net/fs/proc/env/FFI/`unsafe`/rng/clock (`label()`) |
`WorldSnapshot::reachable_from_entrypoints` (multi-source BFS over `calls` from
`is_entrypoint` symbols) and `WorldSnapshot::symbol(id)` back the analyses below.
## f2 — the tripwire battery
[`Tripwire`](../src/scip.rs) (`scip.rs:1442`) is `{ name(), evaluate(from, to) -> Vec<Finding> }`.
[`default_tripwires`](../src/scip.rs) (`scip.rs:2135`) is the **landed battery** — the seven
pairwise tripwires that run on every `diff()`:
| # | tripwire | fires when | severity |
|---|---|---|---|
| 1 | `CallGraphDeltaTripwire` (`scip.rs:1452`) | any call edge added/removed between snapshots | Info |
| 2 | `CapabilityDriftTripwire` (`scip.rs:1478`) | a capability reachable from entrypoints in `to` but not `from` | High |
| 5 | `SinkNewlyReachableTripwire` (`scip.rs:1504`) | a vuln sink reachable in `to` but not `from` — the highest-signal event | ≥ High |
| 3 | `FingerprintDriftTripwire` (`scip.rs:1533`) | a symbol's transitive closure changed while its version + public API did NOT (the silent 5th-level-dep signal) | High |
| 17 | `ObfuscationTripwire` (`scip.rs:1585`) | a symbol's Shannon-entropy fingerprint spikes vs its prior version | High |
| 6 | `MaintainerAnomalyTripwire` (`scip.rs:1700`) | a dep's `owners` set changes — disjoint → takeover, partial → Medium, maintainer-count collapse → Low | ≤ High |
| 20 | `SbomDriftTripwire` (`scip.rs:1637`) | a component (`DepNode::key`) entered/left the world — entered-unverified → Low, else Info | ≤ Low |
Two further tripwires are **declarative and rule-configured**, plugged in at the heavy site via
`diff_with` rather than firing by default:
| # | tripwire | fires when | severity |
|---|---|---|---|
| 21 | `PolicyTripwire` (`scip.rs:1964`) | any [`PolicyRule`] in the set asserts false on the delta (`NoCapabilityGrowth` / `NoNewNativeCode` / `NoUnverifiedDependencyAdded` / `ForbidEcosystem`); `default_policy()` at `scip.rs:1980` | High |
| 22 | `ThresholdTripwire` (`scip.rs:2121`) | any [`ThresholdRule`] numeric bound is crossed (`UnverifiedCentralityOver` / `CapabilitySurfaceGrewBy` / `NewSymbolEntropyOver` / `FanInAtLeast`) | High |
`SinkNewlyReachableTripwire` set-diffs `reachable_from_entrypoints` across the pair;
`FingerprintDriftTripwire` compares `fingerprint(snap, id)` for symbols with identical
package + `display`. The full 25-analysis catalog (families, compute tiers, per-analysis
symbols) is in [`engine-b-analyses.md`](engine-b-analyses.md) — **25 / 25 landed**.
## f3 — the standing graph analyses
Beyond the pairwise tripwires, single-snapshot analyses feed Engine A precision and
monitoring priority:
- [`reachability_gated_vulns(snap)`](../src/scip.rs) (`scip.rs:432`) — **#4**: only the vuln
sinks call-reachable from entrypoints (kills ~90% of version-only false positives);
[`unreachable_vulns`](../src/scip.rs) (`scip.rs:447`) is the complement.
- [`capability_surface(snap)`](../src/scip.rs) (`scip.rs:464`) — **#2**: the labeled-sink set
reachable from entrypoints (the `BTreeSet<Capability>`).
- [`blast_radius(snap)`](../src/scip.rs) (`scip.rs:480`) — **#11**: PageRank over the dep-graph
→ `(node, score)`; [`blast_radius_findings`](../src/scip.rs) (`scip.rs:525`) surfaces the
top-k as findings.
The rest of the standing catalog is landed alongside these — the supply-chain/statistical/legal
analyses (`typosquat_findings`, `release_cadence_anomalies`, `bus_factor_findings`,
`owner_cluster_findings`, `sink_chokepoints`, `diamond_conflicts`, `dep_fanin_outliers`,
`embedding_novelty_findings`, `license_transition_findings`, `change_velocity_anomalies`
`scip.rs:891`), the honeytoken/canary detector
([`honeytoken_findings`](../src/scip.rs) `scip.rs:1806`, **#23**), the beyond-catalog
taint-path SAST ([`taint_path_findings`](../src/scip.rs) `scip.rs:1354`), and the temporal
two-point diff verb ([`warehouse::world_diff`](../src/warehouse.rs) `warehouse.rs:864` →
`WorldEdgeDiff`, **#24**). See [`engine-b-analyses.md`](engine-b-analyses.md) for the full map.
## Surface
No CLI of its own yet — Engine B is driven in code and persisted through
[`warehouse`](warehouse-design.md)'s `capture_world_snapshot` / `record_behavior_delta_findings`
(gated `scip`+`warehouse`). 29 unit tests cover the vocabulary, diff, the tripwire battery and
the standing analyses (`scip.rs::tests`).