Pro · bounded signed execution path
`verglos hunt` verifies whether a finding can be proved locally.
Hunt is the second step in the Verglos CLI trio: scan, hunt, attest. The scanner finds risk deterministically. Hunt is designed to select an approved declarative recipe for a supported finding, run it in a bounded local runtime, and attach a structured verdict to the report. The executor does not run arbitrary model-generated commands or claim general remote DAST coverage.
true
The proof fired in the local sandbox and produced evidence that matches the finding.
false
The local attempt could not reproduce the issue and the finding should not block as verified exploitable.
not_attemptable
The finding needs external infrastructure, credentials, or runtime context that the local sandbox should not fake.
null
No supported verdict was produced because the recipe is gated, unsupported, or the bounded runtime could not complete safely.
Why local sandbox proof
Cloud LLM triage can explain why a finding might matter, but it still asks the buyer to trust inferred severity. Verglos takes the local lane: source stays on the developer machine, proof attempts run beside the repo, and results are stored as evidence fields in `verglos-report.json`.
Current status
The public CLI contains bounded A1/A2 execution for signed, approved recipes, including sanitized reference harnesses for seven A2 families. Hosted entitlement, complete target-code acceptance, provenance, Linux/Docker qualification, independent review, and final release evidence remain open. Free scans do not run the Pro Hunt path.
Implementation surface
The public package contains the bounded Hunt runtime and public-safe reference fixtures. Private shipping records hold qualification, provenance, legal, hosted-entitlement, and review evidence. Technical reviewers can inspect the public CLI repository and package structure on GitHub.
Open packages/hunt README