The whole design follows one belief: known-CVE detection is a job for deterministic tools, and the LLM earns its place only in the assist role. Here is how that belief shapes the layers, the orchestrator, and the repo. 整个设计遵循一个判断：已知 CVE 检测是确定性工具的活，LLM 只在辅助角色里才配上场。下面是这个判断怎么塑造了分层、编排器和仓库结构。
cvehound's coccinelle rules and git-commit comparison are the core of ① — reproducible, no hallucination. The LLM post-processes, it doesn't lead.cvehound 的 coccinelle 规则和 git commit 比对是 ① 的核心——可复现、不幻觉。LLM 做后处理，不当主角。
A missing scanner is marked skipped with a reason, never a crash. A partial report is useful; a stack trace is not. "skipped" is honestly labelled as "not run", not "clean".缺个扫描器就标 skipped 带原因，绝不崩。半份报告有用，堆栈没用。"skipped" 老实标成"没跑"，不是"没问题"。
L1 facts, L2 hints and L3 measurements are shown separately in the report. An LLM "suspected" finding is never presented as an L1 "confirmed" one.L1 事实、L2 提示、L3 实测在报告里分开呈现。LLM 的"疑似"绝不冒充 L1 的"确认"。
The 10 third-party tools are cloned by a script, never committed. The repo tracks method + orchestration; clone-tools.sh rebuilds the tree anywhere.10 个第三方工具靠脚本克隆，绝不提交进库。仓库只版本化方法 + 编排；clone-tools.sh 在任何机器重建工具树。
Every scanner follows the same lifecycle: is the tool present? If not, record skipped. If yes, run it, normalize its output to JSON, and let report merge it.
每个扫描器都走同一条生命周期：工具在不在？不在就记 skipped。在就跑，把输出规整成 JSON，交给 report 合并。
linux-kernel-security-oss/ ├── README.md # overview + quickstart ├── docs/ # method notes 00–08 + this site │ ├── 00-overview.md … 08-report-pipeline.md │ └── index / usage / architecture.html ├── bin/ │ └── ksec # L1 orchestrator (pure py3 stdlib) ├── harness/ # L3 dynamic │ ├── ioctl_leak_probe.c │ └── slabmon.sh ├── scripts/ │ ├── install-deps.sh # one-command system deps │ └── clone-tools.sh # fetch the 10 tools ├── repos/ # cloned tools (bytes NOT in git) └── .claude/commands/ # /kernel-sec-audit (L2)
Don't expect "let Claude read the whole kernel and find bugs" — false-positive rates are high and the context won't fit. State-of-the-art CVE discovery is always LLM paired with a fuzzer, a static checker, or CodeQL. The LLM's real value here is post-processing, explanation, and spec synthesis. 别指望"让 Claude 读整棵内核源码帮我找洞"——误报高、上下文塞不下。实产 CVE 的做法都是 LLM 配 fuzzer、静态 checker 或 CodeQL。LLM 在这里的真实价值是后处理、解释和规格合成。
And every LLM finding is verified back against source and, where possible, measured on a device. The LLM proposes; the deterministic layers and your own testing dispose. 而且每条 LLM 发现都要回源码验证，能实测就实测。LLM 只负责提出；确定性层和你自己的测试负责定夺。