# Exploit

## Winning Approach

The explore winner held at exploit scale: keep WHO finished pharma and APIs on
the same regulatory path, but do not force vaccines into the current
INN-backed WHO drug model.

The exploit implementation stays in the ticket's Python experiment surface
under `architecture/experiments/25-who-vaccines-and-apis/scripts/`. It adds a
reproducible full-scale build, persistent upstream and MyChem caches under
`work/`, an explicit regression-control run against the explore metric
projection, validation for the five ticket vaccines, sample-record output, and
downstream loader/schema proposals.

## Full-Scale Results

- Full-scale scope:
  - finished pharma: `656` rows
  - vaccines: `284` rows
  - APIs: `191` rows
  - immunization devices: `459` products across `11` categories
- API identity and overlap:
  - MyChem raw API INN phrase or exact: `90.05%`
  - MyChem normalized API INN phrase or exact: `91.10%`
  - MyChem normalized API INN exact: `79.06%`
  - API exact normalized-INN overlap to finished pharma: `71.73%`
  - API component overlap to finished pharma: `93.72%`
- Vaccine identity and metadata:
  - best vaccine identity strategy: `component_vaccine_coverage`
  - best vaccine phrase or exact rate: `30.28%`
  - best vaccine exact rate: `17.25%`
  - dose-count completeness: `99.65%`
  - immunization schedule completeness: `0.0%`
  - cold-chain completeness: `0.0%`
- Warm-cache build timings:
  - schema comparison: `0.0363 s`
  - vaccine identity: `0.0615 s`
  - API linkage: `0.0680 s`
  - metadata and devices: `0.0037 s`
  - validation: `0.0022 s`
  - sample-record artifact: `0.0033 s`
  - full exploit build wall time: `0.1808 s`

## Regression Control

The exploit reran the exact explore benchmark on the exploit code and matched
the explore metric projection exactly for all four probe artifacts.

- `schema_comparison`:
  - checksum: `a711f110fd15a5503350192873d38225eb535bbc36d646743189361052366c52`
  - mismatch count: `0`
- `vaccine_identity`:
  - checksum: `f73397131fe57a57ae983b3841ab959c1ccf796a6c99ff32887322e5c0e014e3`
  - mismatch count: `0`
- `api_linkage`:
  - checksum: `8583ab4e03c634f1186627b481eec3224c0e86b19246c6248ff3d9cdc6adfc24`
  - mismatch count: `0`
- `metadata_and_devices`:
  - checksum: `f5e9d7e76185e526eea4273374d57a1902d7505c5203268d380a41c8c34f9239`
  - mismatch count: `0`

There were no checksum changes, no metric regressions, and no carveouts.

Explore did not record latency, throughput, RSS, or build/load baselines, so
the exploit regression rule applied to the measured metric projections only.
The exploit still records warm-cache stage timings for reproducibility in
`who_regression_control.json` and `who_full_scale_results.json`.

## Validation

Ticket validation passed for all five required vaccine anchors, with each
target present in the WHO vaccine export and at least one matched row carrying
all required metadata fields (`Vaccine Type`, `Commercial Name`,
`Presentation`, `Manufacturer`, `Responsible NRA`, `Date of Prequalification`).

- `BCG`: `7` rows
- `measles`: `22` rows
- `HPV`: `6` rows
- `COVID-19`: `4` rows
- `yellow fever`: `10` rows

Remaining gap:

- Validation confirms discoverability and metadata presence, not drug-identity
  suitability. Vaccines still fail the ticket's identity-linkage success bar.

## Produced Artifacts

- Explore-compatible probe outputs:
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_schema_comparison.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/vaccine_identity_probe.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/api_linkage_probe.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/vaccine_metadata_and_device_probe.json`
- Exploit-only result artifacts:
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_vaccines_apis_summary.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_regression_control.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_validation.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_sample_records.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_loader_design.json`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/results/who_full_scale_results.json`
- Exploit source code:
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/scripts/who_vaccines_apis_lib.py`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/scripts/who_vaccines_apis_exploit.py`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/scripts/build_full_scale_results.py`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/scripts/regression_control.py`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/scripts/validate_vaccines.py`
- Persistent local caches:
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/work/upstream/`
  - `/home/ian/workspace/worktrees/231-spike-who-vaccines-and-api-extensions/architecture/experiments/25-who-vaccines-and-apis/work/mychem_query_cache.json`

## Contract Numbers

Downstream spikes can depend on these exploit-measured values:

- WHO row counts:
  - finished pharma: `656`
  - vaccines: `284`
  - APIs: `191`
  - immunization devices: `459`
  - device categories: `11`
- WHO API identity:
  - normalized-INN MyChem phrase or exact: `91.10%`
  - normalized-INN MyChem exact: `79.06%`
  - finished-pharma exact overlap: `71.73%`
  - finished-pharma component overlap: `93.72%`
- WHO vaccine identity and metadata:
  - best phrase or exact identity rate: `30.28%`
  - best exact identity rate: `17.25%`
  - dose-count completeness: `99.65%`
  - schedule completeness: `0.0%`
  - cold-chain completeness: `0.0%`
- Vaccine validation counts:
  - `BCG`: `7`
  - `measles`: `22`
  - `HPV`: `6`
  - `COVID-19`: `4`
  - `yellow fever`: `10`
- Warm-cache exploit build wall time:
  - `0.1808 s`

## Conclusions

The exploit confirms the explore decision without any regression-control
carveouts: APIs are strong enough to extend the WHO drug path, while vaccines
still need a separate loader or a vaccine-specific schema extension.

The deliverables now support downstream implementation work directly. The
experiment has persistent cached WHO payloads, a persistent MyChem query cache,
exploit-time contract numbers, a validation artifact, sample records, and an
explicit design proposal for `product_type` filtering and `WhoPrequalification`
row extensions.

The main remaining risk is model design, not basic feasibility. APIs still need
row-shape adjustments such as `who_product_id`, `grade`, and confirmation-date
support. Vaccines remain blocked on missing INN, schedule, and cold-chain data,
so they should not be added to the current WHO drug surface as-is.
