# Exploit

## Winning Approach

The explore winner held at full scale: use GTR bulk data as the diagnostic
backbone, then layer FDA and WHO records on top as source-native regulatory
overlays instead of trying to force a symmetric three-source merge.

The exploit implementation keeps the explore probes intact for regression
control and adds a full-scale Python pipeline under
`architecture/experiments/24-diagnostic-entity-landscape/scripts/` to build the
ClinVar gene universe, compute source coverage, emit 100-record extracts, and
validate the BRCA1 anchor panels.

## Full-Scale Results

- ClinVar gene universe:
  - primary full-scale set: `11085` unique gene symbols with nonzero
    `Alleles_reported_Pathogenic_Likely_pathogenic` in ClinVar
    `gene_specific_summary.txt` dated `April 14, 2026`
  - sanity check from `variant_summary.txt.gz`: `15027` all-pathogenic unique
    symbols, `10739` germline-pathogenic unique symbols
- GTR backbone:
  - current tests: `64374`
  - total GTR genes linked by current tests: `19406`
  - ClinVar pathogenic genes with at least one GTR test: `8386 / 11085`
    (`75.65%`)
  - OMIM-tagged ClinVar subset with at least one source hit:
    `7951 / 8170` (`97.32%`)
  - LOC / antisense / hyphenated long-tail subset with at least one source hit:
    `130 / 2294` (`5.67%`)
- WHO IVD overlay:
  - rows: `435`
  - ClinVar pathogenic genes matched in WHO marker text: `4 / 11085` (`0.04%`)
- FDA molecular overlay:
  - unique records after PMA / 510(k) dedupe: `128`
  - PMA: `47`
  - 510(k): `81`
  - ClinVar pathogenic genes matched from FDA record text: `14 / 11085`
    (`0.13%`)
- Combined coverage:
  - genes with any source hit: `8386 / 11085` (`75.65%`)
  - WHO and FDA add regulatory value but no meaningful incremental gene
    coverage beyond the GTR backbone on this full-scale gene universe
- Build timings:
  - full pipeline wall time: `68.1 s`
  - ClinVar gene summary load: `0.16 s`
  - ClinVar variant-summary sanity check: `53.36 s`
  - GTR parse / join: `4.17 s`
  - WHO scan: `0.01 s`
  - FDA slice build: `10.04 s`

## Regression Control

The exact explore correctness payloads matched on rerun for:

- `gtr_bulk`
- `gtr_api`
- `who_ivd`
- `fda_device`
- `cross_source_matrix`

Evidence:

- Projection checksums matched for all five artifacts in
  `results/diagnostic_regression_control.json`.
- Exact-count mismatch count was `0` for all five artifacts.
- `gtr_bulk` runtime improved from `7.08 s` to `3.66 s`.

Two latency metrics required explicit noise waivers because the live services
were materially more variable than the explore snapshot, even though the
correctness payloads were unchanged.

Waiver 1: `gtr_api` live latency, applying the `3%` latency rule

- Explore baseline:
  - mean gene search: `121.1 ms`
  - mean gene summary: `382.02 ms`
  - mean disease search: `126.47 ms`
  - mean disease summary: `604.93 ms`
- Literal reruns in `diagnostic_regression_control.json` landed outside the
  `3%` band on some passes even though the projection checksum stayed identical.
- Noise evidence from `diagnostic_live_latency_noise_probe.json`:
  - gene rounds:
    - `117.98 / 394.64 ms`
    - `120.64 / 411.8 ms`
  - disease rounds:
    - `127.53 / 624.0 ms`
    - `392.7 / 647.87 ms`
- Cause:
  - the live NCBI GTR endpoint is transport-variable at this scale
  - the returned IDs, counts, and examples were stable across reruns
  - the variance was concentrated in request latency, not in correctness output

Waiver 2: `fda_device` sample fetch latency, applying the `3%` latency rule

- Explore baseline:
  - sample fetch latency: `598.3 ms`
- Literal reruns in `diagnostic_regression_control.json` hit `726.8 ms` and
  `736.8 ms`.
- Noise evidence from `diagnostic_live_latency_noise_probe.json`:
  - three identical repeated sample fetches landed at `728.0 ms`, `639.3 ms`,
    and `523.2 ms`
- Cause:
  - openFDA first-page latency is highly variable on identical requests
  - the reported total and the projection checksum stayed unchanged

Real regression fixed during exploit:

- The first exploit checksum comparison for `cross_source_matrix` incorrectly
  treated embedded latency fields as correctness output. The regression-control
  script now strips those fields before computing the projection checksum.
- The first full-scale report overstated the ClinVar gene universe by counting
  duplicate symbols from `gene_specific_summary.txt`. The full-scale build now
  dedupes ClinVar by gene symbol before computing coverage percentages.

## Validation

Manual BRCA1 spot-checks passed in both the GTR backbone and the FDA overlay.

- GTR hits:
  - `GTR000603548.1` `myChoice CDx`
  - `GTR000593446.2` `FoundationOne Liquid CDx`
  - `GTR000527976.2` `FoundationOne`
  - `GTR000558436.14` and `GTR000613444.1` `Tempus xT`
- FDA hits:
  - `P190014` `MyChoice CDx`
  - `P170019` `FoundationOne CDx`
  - `P190032` / `P200006` `FoundationOne Liquid CDx`
  - `P210011` `xT CDx`

Validation artifacts:

- `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_validation.json`

Remaining gap:

- FDA and WHO records do not provide enough gene-linked text to change the
  backbone coverage story. They validate the overlay strategy, not a unified
  ingest-first identity model.

## Produced Artifacts

- Full-scale source landscape:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_full_scale_landscape.json`
- Full gene-by-source matrix:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_gene_source_matrix.json`
- Sample extracts:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_gtr_sample_100.json`
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_who_ivd_sample_100.json`
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_fda_molecular_sample_100.json`
- Regression control:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_regression_control.json`
- Live-latency waiver evidence:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_live_latency_noise_probe.json`
- Validation hits:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/results/diagnostic_validation.json`
- Exploit source code:
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/scripts/diagnostic_landscape_lib.py`
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/scripts/build_full_scale_landscape.py`
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/scripts/regression_control.py`
  - `/home/ian/workspace/worktrees/230-spike-gtr-and-diagnostic-entity-data-landscape/architecture/experiments/24-diagnostic-entity-landscape/scripts/live_latency_noise_probe.py`

The proposed unified data model, CLI surface, source priority order, and Rust
module boundaries are embedded in `diagnostic_full_scale_landscape.json`.

## Contract Numbers

Downstream spikes can depend on these exploit-measured values:

- ClinVar pathogenic gene universe:
  - `11085` unique symbols from `gene_specific_summary.txt` dated
    `April 14, 2026`
- GTR backbone:
  - `64374` current tests
  - `8386 / 11085` ClinVar-pathogenic genes covered (`75.65%`)
- Clinically named subset:
  - `7951 / 8170` OMIM-tagged genes covered (`97.32%`)
- WHO overlay:
  - `435` rows
  - `4` ClinVar genes with any WHO marker hit
- FDA overlay:
  - `128` unique molecular diagnostic records
  - `47` PMA records
  - `81` 510(k) records
  - `14` ClinVar genes with any FDA text hit
- Full exploit build wall time:
  - `68.1 s`

## Conclusions

The full-scale exploit confirms the explore conclusion. A useful `diagnostic`
entity is justified if BioMCP ships GTR first and treats FDA plus WHO as typed
overlays.

The raw ClinVar-symbol coverage target missed the ticket’s `>80%` goal because
today’s ClinVar gene summary includes a large tail of loci, antisense
transcripts, and other non-anchor symbols. On the clinically named subset,
coverage is already `97.32%`, which is strong enough to justify a GTR-backed
entity for downstream implementation spikes.

The main remaining risk is not the local code path. It is live-service
volatility in the optional GTR API and openFDA fetch latencies. That reinforces
the exploit design choice: use bulk local files for completeness-critical
workflows and keep the live APIs as secondary query or overlay surfaces.
