JANISSARY 7.3.0: F1 0.921, reproducible in one command

7.3.0 is out. Code freeze — functionally complete, frozen to prevent regressions. Release notes: github.com/Hetaireia/janissary/releases/tag/7.3.0. Docker: oraclemode337/janissary:7.3.0. PyPI: janissary==7.3.0.

TL;DR: F1 0.921 on the OWASP Benchmark DAST-applicable corpus. Precision 1.000. Committed run artifacts. One command to reproduce. And here's what it misses, before you install.

The benchmark number — reproduced, not asserted

The 0.920 figure from the earlier post was measured on v7.2.0. The v7.2.0 run artifacts weren't committed, so it was project-reported, not reproducible. That was the honest but weak position.

This is the strong one:

DAST-APPLICABLE  TP 987  FP 0  FN 169  TN 1102  P 1.000  R 0.854  F1 0.921

Reproduced on v7.3.0 against the same pinned target (OWASP Benchmark commit 20cbf3d111…), under the pre-registered methodology in BENCHMARK.md. Amendment 21 records the protocol, the deviation from the 3-run baseline (documented, with reasoning), and the exact reproduce command.

Two numbers, both traceable:

• Single-pass baseline: F1 0.902 (TP 950 / FN 206)
• FN-recovery at JANISSARY_TIMEOUT=180: F1 0.921 (TP 987 / FN 169)

The 0.902 to 0.921 jump is the Amendment 20 recovery protocol: re-scan the misses at a longer timeout, merge, re-score. Documented in the pre-registration before the run, not after.

Delta vs Amendment 20 (v7.2.0: F1 0.920, TP 984): +3 TP, +0.001 F1 — within the ±13 TP run-to-run noise floor stated in BENCHMARK.md line 654. The claim reproduces.

The receipt: all three run directories committed under benchmark/track_a/runs/. To verify:

python benchmark/track_a/score_dast_aware.py benchmark/track_a/runs/20261024T130735Z-janissary-r1+rec

That's it. You should get TP 987 / FN 169 / F1 0.921. If you don't, the claim is wrong and you should say so.

What it's good at

• Deduplication. DVWA run: 8 CRITICAL signals grouped into 1 finding. That's the thing triage-fatigued users actually need.
• WAF evidence. Live ModSecurity: pacer backed off to 30.0s across 38 events. Observed backoff behavior, not a claimed bypass.
• Framework-specific SQLi. Paren-closing payloads verified live.

What it misses — read before installing

• SPA catch-all false positives. 39 FPs on a Node SPA in the Juice Shop run. WordPress-admin-module rule fires on catch-all routing. Issue #1.
• 401 aborts the scan for that path. Auth-gated targets can hide findings downstream. Issue #2.
• Pathtraver recall 0.049–0.308. Not a weak result — an unsupported class. Do not use JANISSARY for path traversal in 7.x. Use something else.
• One case still times out at 180s (BenchmarkTest02321, xss-04, param_name). Counted as FN. Documented in Amendment 21.

What's next

8.x gets:

• Issue #4 — generalize the six-oracle pattern to close the misattribution class.
• Issue #5 — --mode ci, fast and unpaced for trusted pipelines.
• Payload-set generalization for framework-wrapped queries.

7.x gets hotfixes only.

Install

docker pull oraclemode337/janissary:7.3.0
pip install janissary==7.3.0

443 tests passing. main is clean at the tag.

If 7.3.0 gets something wrong, open an issue. The ledger is public.