The moat · public-facing patterns

Knowledge Base

Every unique bug pattern MagnusQA has ever seen, anonymized. Customers can browse to see what we test for; operators see the example_sites_seen. Authenticated read at /api/v1/kb.

Browse patterns

Each pattern carries a category (accessibility / security / performance / …), severity default, symptoms, root cause, detection rule, prevention rule, and times_seen. Sorted by frequency.

GET /api/v1/kb?category=security&limit=50

Maturity ladder

  • · novice — new pattern, low confidence
  • · apprentice — seen 5+ times across 3+ sites
  • · journeyman — high recall, low FP rate
  • · expert — canonical — injected into Forge prompts

Two-tier training feed

External QA reports are ingested at /api/v1/internal/external-findings. Anything they caught and we didn’t enters training_ingestion_queue, gets categorized, and (after operator review) becomes a new KB pattern.

Prompt injection block

Operators can pull a Markdown-formatted block of prevention rules ready to paste into Claude Code or Magnus Forge:

GET /api/v1/kb/inject?categories=security,accessibility&format=claude_code

(operator-only; requires x-operator-key)

Add a pattern (admin)

Operators can add a hand-curated pattern via POST /api/v1/kb with category, symptoms, detection_rule, and prevention_rule.