feat: add exhaustive-path-tracing to security audit template

[Alan-Jowett]

Summary

Add the exhaustive-path-tracing protocol to the investigate-security template so that security audits systematically deep-analyze parser and decoder functions that process untrusted structured input.

Changes

File	Change
templates/investigate-security.md	Add reasoning/exhaustive-path-tracing to protocol list; add instruction 7 (parser/decoder deep analysis criteria and attention items); expand investigation plan from 5 to 7 steps; add coverage ledger to quality checklist
protocols/reasoning/exhaustive-path-tracing.md	Add investigate-security to applicable_to list
manifest.yaml	Add exhaustive-path-tracing to protocol list; update description

Motivation

The investigate-security template previously included exhaustive-path-tracing only as a comment in the template body instructions but did not declare it in the protocol list or provide criteria for when to apply it. This meant the protocol's full methodology (structural mapping, per-function path tracing, coverage ledgers) was not consistently invoked during security audits.

During a real security audit of a QUIC protocol implementation, the most impactful confirmed finding (ACK frame last-iteration integer underflow) was in exactly the class of function this protocol targets: a loop decoding multiple fields from a wire format with inter-value arithmetic on a running accumulator.

Design Decisions

• Selective application: The protocol is marked optional and scoped to functions meeting all three criteria (multi-field decode, inter-value arithmetic, iteration with shared state). This prevents over-application to simple functions.
• Three specific attention items: Inter-value arithmetic validation, loop-carried invariant gaps, and truncation after bounds check — derived from real false-negative and true-positive patterns observed in the audit.
• Investigation plan expansion: Steps 3 (identify parsers) and 5 (deep-dive) make the workflow explicit rather than leaving parser identification to ad-hoc judgment.

Checklist

• All files have SPDX license headers
• YAML frontmatter is valid and complete
• Component names match file names (kebab-case)
• manifest.yaml updated with all new components
• No vague instructions in protocols or templates
• Templates have a quality checklist section
• New components do not conflict with existing ones

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds the exhaustive-path-tracing protocol to the security audit template configuration so audits consistently apply deeper parser/decoder path analysis for untrusted structured input.

Changes:

• Expand investigate-security template manifest description to mention selective exhaustive path tracing for parsers/decoders.
• Add exhaustive-path-tracing to the investigate-security template’s protocol list in manifest.yaml.

Reviewed changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

File	Description
manifest.yaml	Updates the investigate-security template metadata to include exhaustive-path-tracing and describe its selective use
templates/investigate-security.md	Not included in provided diff; PR metadata indicates protocol list + investigation steps expanded
protocols/reasoning/exhaustive-path-tracing.md	Not included in provided diff; PR metadata indicates applicability updated

[Copilot]

The PR description indicates the protocol identifier being added to templates is reasoning/exhaustive-path-tracing, but this manifest entry adds exhaustive-path-tracing without the reasoning/ prefix. If protocol IDs are expected to match exactly across the manifest and template/protocol definitions, this mismatch can cause the protocol to not resolve (or be duplicated under two IDs). Align the manifest entry with the canonical protocol identifier used elsewhere (either add the reasoning/ prefix here, or standardize on the unprefixed name across all references).

Suggested change

	protocols: [anti-hallucination, self-verification, operational-constraints, adversarial-falsification, security-vulnerability, exhaustive-path-tracing]
	protocols: [anti-hallucination, self-verification, operational-constraints, adversarial-falsification, security-vulnerability, reasoning/exhaustive-path-tracing]