nightly: refresh public-CVE cut (automated; release-cert passing)

README.md

@@ -45,10 +45,10 @@ trained on `public-cve-replication` primitives only).
 - Decision threshold 0.5 (calibrated). Inference is **scoreability-gated**: a record with no network
   signal (e.g. an economic/DeFi bundle) returns `scoreable=False` with no verdict.
 
-## Training data — 40 public-CVE attack primitives, 9 chains, 1262 bundles
+## Training data — 47 public-CVE attack primitives, 9 chains, 1434 bundles
 
-**This is the public-CVE cut** (`public-cve-replication` only): 850 attack + 412 benign
-bundles (`pcap + responses + manifest`), 46 chain×primitive instances. Benign traffic
+**This is the public-CVE cut** (`public-cve-replication` only): 966 attack + 468 benign
+bundles (`pcap + responses + manifest`), 53 chain×primitive instances. Benign traffic
 exercises the **same methods / wire messages** the attacks abuse, at normal scale — so the model
 separates attack-*use* from benign-*use*, not message type. Every attack reproduces an external public
 disclosure with a `provenance.public_source` URL. (0 `original` primitives — NullRabbit's own
@@ -79,15 +79,22 @@ above is literal.)
 | `btc_version_selfnonce` | Bitcoin · p2p | [CVE-2025-54604](https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54604/) | public-cve-replication |
 | `btc_version_timestamp_overflow` | Bitcoin · p2p | [CVE-2024-52912](https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/) | public-cve-replication |
 | `p2p_getheaders_drain` | Bitcoin / Dogecoin / Litecoin · p2p | [CVE-2023-33297](https://nvd.nist.gov/vuln/detail/CVE-2023-33297) | public-cve-replication |
+| `cometbft_bitarray_mismatch` | Cosmos · cometbft-p2p-secretconn | [GHSA-hrhf-2vcr-ghch](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch) | public-cve-replication |
+| `cometbft_blockpart_mismatch` | Cosmos · cometbft-p2p-secretconn | [GHSA-r3r4-g7hq-pq4f](https://github.com/advisories/GHSA-r3r4-g7hq-pq4f) | public-cve-replication |
+| `cometbft_voteext_panic` | Cosmos · cometbft-p2p-secretconn | [GHSA-p7mv-53f2-4cwj](https://github.com/cometbft/cometbft/security/advisories/GHSA-p7mv-53f2-4cwj) | public-cve-replication |
+| `cosmos_gogoproto_skippy` | Cosmos · rpc-broadcast-tx | [CVE-2021-3121](https://osv.dev/vulnerability/CVE-2021-3121) | public-cve-replication |
+| `cosmos_group_divzero_halt` | Cosmos · rpc-group-module-tx | [GHSA-x5vx-95h7-rv4p](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-x5vx-95h7-rv4p) | public-cve-replication |
 | `cosmos_p2p_conn_flood` | Cosmos · tcp-p2p-conn-flood | [CVE-2020-5303](https://github.com/tendermint/tendermint/security/advisories/GHSA-v24h-pjjv-mcp6) | public-cve-replication |
 | `cosmos_protobuf_nest_bomb` | Cosmos · rpc-broadcast-tx | [GHSA-8wcc-m6j2-qxvm](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-8wcc-m6j2-qxvm) | public-cve-replication |
 | `geth_devp2p_ping_flood` | Ethereum · devp2p-rlpx | [CVE-2023-40591](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-ppjg-v974-84cm) | public-cve-replication |
 | `geth_eth_receipt_flood` | Ethereum · devp2p-rlpx | [EL-2024-20](https://reports.immunefi.com/ethereum-protocol-or-attackathon/37466-bc-medium-evil-client-oom-crash-fast-p2p-crash) | public-cve-replication |
+| `geth_getblockheaders_count_zero` | Ethereum · devp2p-rlpx | [CVE-2024-32972](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-4xc9-8hmq-j652) | public-cve-replication |
 | `geth_rlpx_auth_flood` | Ethereum · devp2p-rlpx | [EL-2026-06](https://notes.ethereum.org/gDWKW5RtSym02t2aGYkmSQ) | public-cve-replication |
 | `geth_snap_trienode_dos` | Ethereum · devp2p-rlpx | [CVE-2021-41173](https://github.com/ethereum/go-ethereum/security/advisories/GHSA-59hh-656j-3p7v) | public-cve-replication |
 | `geth_tcp_handshake_flood` | Ethereum · devp2p-rlpx | [EL-2024-06](https://reports.immunefi.com/ethereum-protocol-or-attackathon/37120-bc-insight-remote-handshake-based-tcp-30303-flooding-leads-to-an-out-of-memory-crash) | public-cve-replication |
 | `monero_levin_array_memcorrupt` | Monero · levin-p2p | [CVE-2018-3972](https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0637) | public-cve-replication |
 | `monero_portable_storage_oom` | Monero · levin-p2p | [PR#7190](https://github.com/monero-project/monero/pull/7190) | public-cve-replication |
+| `monero_rpc_conn_exhaustion` | Monero · http-rpc | [CVE-2025-26819](https://nvd.nist.gov/vuln/detail/CVE-2025-26819) | public-cve-replication |
 | `sol_tpu_quic_handshake_flood` | Solana · tpu-quic | [ND-FD04-LO-01](https://neodyme.io/reports/Firedancer-v0.4.pdf) | public-cve-replication |
 | `sol_tpu_quic_initial_cpu` | Solana · tpu-quic | [ND-FD1-MD-02](https://neodyme.io/reports/Firedancer.pdf) | public-cve-replication |
 | `sol_tpu_quic_slowloris` | Solana · tpu-quic | [ND-FD04-IN-02](https://neodyme.io/reports/Firedancer-v0.4.pdf) | public-cve-replication |
@@ -99,8 +106,8 @@ above is literal.)
 | `libp2p_signed_peer_record_flood` | libp2p · libp2p-gossipsub | [CVE-2023-40583](https://github.com/advisories/GHSA-gcq9-qqwx-rgj3) | public-cve-replication |
 | `libp2p_stream_exhaustion` | libp2p · libp2p-gossipsub | [CVE-2022-23492](https://github.com/advisories/GHSA-j7qp-mfxf-8xjw) | public-cve-replication |
 
-Distribution: **850** `public-cve-replication` attack bundles — **40 distinct primitives
-across 9 chains** (Bitcoin, Cosmos, Dogecoin, Ethereum, libp2p, Litecoin, Monero, Solana, Sui) — plus **412** benign. This published cut contains
+Distribution: **966** `public-cve-replication` attack bundles — **47 distinct primitives
+across 9 chains** (Bitcoin, Cosmos, Dogecoin, Ethereum, libp2p, Litecoin, Monero, Solana, Sui) — plus **468** benign. This published cut contains
 **no `original` bundles**; the `original` RPC-measurement primitives live in the full internal corpus
 and ship only if the operator explicitly opts in, always under their honest label.
 
@@ -118,9 +125,9 @@ the numbers below always match the shipped model.
 Diagnostic ML checks (the corpus of faithfully-modelled public attacks is the deliverable; these are
 secondary). Reproduced by `scripts/known_class_loco_eval.py` + `scripts/corpus_quality.py`.
 
-- **Within-corpus held-out — binary attack-vs-benign ROC-AUC, GroupKFold by primitive: 0.8985.** `corpus_sha256 known-class-v10-publiccve`.
-- **Leave-one-chain-out — binary ROC-AUC (HARD zero-shot transfer, *not* a deployment metric):** Cosmos 1.000 / Litecoin 1.000 / Dogecoin 0.997 / Ethereum 0.969 / Bitcoin 0.910 / Sui 0.779 / libp2p 0.762 / Solana 0.641 / Monero 0.631. Chains with few public-CVE primitives have the fewest cross-chain near-neighbours; the companion [`nr-bundles-public`](https://huggingface.co/datasets/NullRabbit/nr-bundles-public) dataset card reports the *stricter* held-out-chain 7-class family macro-F1 (0.17 Sui / 0.35 Solana vs ~0.14 floor). Reported honestly, not a deployment claim.
-- **Leave-one-attack-primitive-out within Bitcoin (leak-clean disjoint-benign):** all Bitcoin primitives ≥ 0.997. Detection is on traffic *shape*, not deep wire-semantics.
+- **Within-corpus held-out — binary attack-vs-benign ROC-AUC, GroupKFold by primitive: 0.9563.** `corpus_sha256 known-class-v10-publiccve`.
+- **Leave-one-chain-out — binary ROC-AUC (HARD zero-shot transfer, *not* a deployment metric):** Dogecoin 1.000 / Litecoin 1.000 / Sui 1.000 / Ethereum 0.996 / Cosmos 0.964 / Bitcoin 0.897 / libp2p 0.887 / Monero 0.770 / Solana 0.625. Chains with few public-CVE primitives have the fewest cross-chain near-neighbours; the companion [`nr-bundles-public`](https://huggingface.co/datasets/NullRabbit/nr-bundles-public) dataset card reports the *stricter* held-out-chain 7-class family macro-F1 (0.17 Sui / 0.35 Solana vs ~0.14 floor). Reported honestly, not a deployment claim.
+- **Leave-one-attack-primitive-out within Bitcoin (leak-clean disjoint-benign):** all Bitcoin primitives ≥ 0.988. Detection is on traffic *shape*, not deep wire-semantics.
 
 ## Intended uses
 

model.joblib

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:bc7dacf4ec8feca8b9285b168cafa2f30a6cea0b9158a0dca12d09e085f680c4
-size 3098589
+oid sha256:de12ca63dcdd08dc66f90b25b2b3a5f9d5f982a14c77897f4578e3e5c44c37ec
+size 3102813