Nobody tells it your rules.

DSA learns the checks your routes share, then points at the one that skips them.

One loophole. Three routes in line.

Peer comparison without hardcoded rules.

No fixed rule names. It compares routes, commands and handlers with their siblings.

Peers
Nine routes, read side by side.
It reads which checks each route runs. Nobody told it what gatekeeper_v2() or workspace_fence() mean.
House rules
Checks most peers share become rules.
POST /v1/export skips workspace_fence(), which 8 of its 9 peers run. Over on the right, tenant_audit() is defined and never called.
Amplified
Small gaps stay small. Real holes jump.
The gap of −0.26 goes through e^4.5·|δ| − 1 and lands at−2.27. Gaps under 0.06 count as zero, so noise stays flat. A guard nobody calls spikes upward.
After hardening
One commit later, everything reads 0.00.
The fix adds the missing check, on its own branch.