From 3cdec8e621f49d2f5b2842bfbc6d006956cd90b0 Mon Sep 17 00:00:00 2001 From: Renn F Date: Sat, 10 Oct 2026 17:35:16 +0200 Subject: [PATCH] chore: vendor guard-core spec 4.1.0 corpus at engine 4.3.2 Replaces the 22 vendored corpus files (index + 21 suites, 375 cases, 94 safety_gates + 9 cost_bodies) byte-identical with the reference regen at engine 4.3.2 (spec 4.1.0 unchanged). File set unchanged: same 22 names, same per-suite case counts, updated expectations. Events ledger: the 4.3.2 regen pins expected: [] for the bus-emitted event_stream cases because the reference generation environment lacks the optional guard_agent module (SecurityEvent construction imports it and the reference bus swallows the failure), so the capture harness recorded zero envelopes. Applied per the fail-closed policy: removed 5 stale entries (evt_behavioral_violation_usage_log, evt_ip_unbanned, evt_path_excluded_health, evt_pattern_detected_xss, evt_security_bypass_all) whose cases now compare 0 against 0 and pass with their documented port gaps unchanged; added 2 entries with per-case reasons (evt_country_blocked_geo, evt_geo_lookup_failed_) download) where the port emits and the corpus pins zero; re-reasoned the count-level entries. The 4 envelope-pinned cases pass unchanged. Gates: detect 193/193, safety 69 passed + 25 xfail of 94, pipeline 35/35, redis_interop 7 passed + 7 xfail of 14, events 9 passed + 29 xfail + 1 advisory skip of 38, cost budgets 9/9 under ceilings. --- .../guard-core-spec-4.1.0/cases/benign.json | 2 +- .../cases/binary_bodies.json | 2 +- .../cases/boundaries.json | 2 +- .../cases/cmd_injection.json | 2 +- .../cases/context_matrix.json | 2 +- .../cases/cost_bodies.json | 2 +- .../guard-core-spec-4.1.0/cases/encoding.json | 2 +- .../cases/event_stream.json | 929 +----------------- .../cases/inclusion_sensitive_recon.json | 2 +- .../guard-core-spec-4.1.0/cases/index.json | 41 +- .../cases/misc_injection.json | 2 +- .../cases/path_traversal.json | 2 +- .../cases/pipeline_behavior_rules.json | 2 +- .../cases/pipeline_detection_response.json | 2 +- .../cases/pipeline_headers_cors.json | 2 +- .../cases/pipeline_ip_control.json | 2 +- .../cases/pipeline_rate_limits.json | 2 +- .../cases/redis_interop.json | 2 +- .../cases/safety_gates.json | 2 +- .../guard-core-spec-4.1.0/cases/semantic.json | 2 +- .../guard-core-spec-4.1.0/cases/sqli.json | 2 +- .../guard-core-spec-4.1.0/cases/xss.json | 2 +- .../php_events_xfail.json | 61 +- 23 files changed, 105 insertions(+), 966 deletions(-) diff --git a/conformance/guard-core-spec-4.1.0/cases/benign.json b/conformance/guard-core-spec-4.1.0/cases/benign.json index 3aaaabf..86688a4 100644 --- a/conformance/guard-core-spec-4.1.0/cases/benign.json +++ b/conformance/guard-core-spec-4.1.0/cases/benign.json @@ -2,7 +2,7 @@ "suite": "benign", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "benign_plain_text", diff --git a/conformance/guard-core-spec-4.1.0/cases/binary_bodies.json b/conformance/guard-core-spec-4.1.0/cases/binary_bodies.json index 53c32a9..59e57ae 100644 --- a/conformance/guard-core-spec-4.1.0/cases/binary_bodies.json +++ b/conformance/guard-core-spec-4.1.0/cases/binary_bodies.json @@ -2,7 +2,7 @@ "suite": "binary_bodies", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "binary_benign_zip_upload_seed11", diff --git a/conformance/guard-core-spec-4.1.0/cases/boundaries.json b/conformance/guard-core-spec-4.1.0/cases/boundaries.json index ac4211c..280d67c 100644 --- a/conformance/guard-core-spec-4.1.0/cases/boundaries.json +++ b/conformance/guard-core-spec-4.1.0/cases/boundaries.json @@ -2,7 +2,7 @@ "suite": "boundaries", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "boundary_padded_attack", diff --git a/conformance/guard-core-spec-4.1.0/cases/cmd_injection.json b/conformance/guard-core-spec-4.1.0/cases/cmd_injection.json index 7cc463a..2f89978 100644 --- a/conformance/guard-core-spec-4.1.0/cases/cmd_injection.json +++ b/conformance/guard-core-spec-4.1.0/cases/cmd_injection.json @@ -2,7 +2,7 @@ "suite": "cmd_injection", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "cmdi_semicolon_cat", diff --git a/conformance/guard-core-spec-4.1.0/cases/context_matrix.json b/conformance/guard-core-spec-4.1.0/cases/context_matrix.json index bd6c0c9..de50807 100644 --- a/conformance/guard-core-spec-4.1.0/cases/context_matrix.json +++ b/conformance/guard-core-spec-4.1.0/cases/context_matrix.json @@ -2,7 +2,7 @@ "suite": "context_matrix", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "ctx_trav_url_path", diff --git a/conformance/guard-core-spec-4.1.0/cases/cost_bodies.json b/conformance/guard-core-spec-4.1.0/cases/cost_bodies.json index 3883815..adabd04 100644 --- a/conformance/guard-core-spec-4.1.0/cases/cost_bodies.json +++ b/conformance/guard-core-spec-4.1.0/cases/cost_bodies.json @@ -2,7 +2,7 @@ "suite": "cost_bodies", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.2.0", + "engine_version": "4.3.2", "cases": [ { "id": "cost_prose_8kib", diff --git a/conformance/guard-core-spec-4.1.0/cases/encoding.json b/conformance/guard-core-spec-4.1.0/cases/encoding.json index 9f56230..d79e0c9 100644 --- a/conformance/guard-core-spec-4.1.0/cases/encoding.json +++ b/conformance/guard-core-spec-4.1.0/cases/encoding.json @@ -2,7 +2,7 @@ "suite": "encoding", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "enc_base64_xss_payload", diff --git a/conformance/guard-core-spec-4.1.0/cases/event_stream.json b/conformance/guard-core-spec-4.1.0/cases/event_stream.json index 32ab8d5..65dfbe5 100644 --- a/conformance/guard-core-spec-4.1.0/cases/event_stream.json +++ b/conformance/guard-core-spec-4.1.0/cases/event_stream.json @@ -2,7 +2,7 @@ "suite": "event_stream", "kind": "events", "spec_version": "4.1.0", - "engine_version": "4.2.0", + "engine_version": "4.3.2", "doc": "Full event-surface corpus: one case per engine event type in guard_core/core/events/event_types.py (plus one passive-mode variant). Each expected entry is the FULL SecurityEvent envelope captured from the live reference engine through the real SecurityEventBus / handler send_event seams, minus the volatile fields listed in comparison.events_volatile_fields (dropped recursively). Compare only the keys present in each expected envelope; a runner that cannot observe a field records its absence instead of failing. Cases with xfail=true are advisory: the event type has no deterministic in-process driver (see xfail_reason) and the runner may skip them.", "cases": [ { @@ -17,27 +17,7 @@ "body": "" } ], - "expected": [ - { - "event_type": "penetration_attempt", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Penetration attempt detected: Request body: Value matched pattern ']*>[^<]*<\\/script\\s*>'", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "request_count": 1, - "trigger_info": "Request body: Value matched pattern ']*>[^<]*<\\/script\\s*>'" - } - } - ] + "expected": [] }, { "id": "evt_penetration_attempt_passive", @@ -53,28 +33,7 @@ "body": "" } ], - "expected": [ - { - "event_type": "penetration_attempt", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "logged_only", - "reason": "Suspicious pattern detected (passive mode): Request body: Value matched pattern ']*>[^<]*<\\/script\\s*>'", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "request_count": 1, - "passive_mode": true, - "trigger_info": "Request body: Value matched pattern ']*>[^<]*<\\/script\\s*>'" - } - } - ] + "expected": [] }, { "id": "evt_ip_blocked_global_blacklist", @@ -91,27 +50,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "ip_blocked", - "ip_address": "203.0.113.11", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "IP 203.0.113.11 not in global allowlist/blocklist", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "ip_address": "203.0.113.11", - "filter_type": "global" - } - } - ] + "expected": [] }, { "id": "evt_ip_banned_then_blocked", @@ -129,45 +68,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "ip_banned", - "ip_address": "203.0.113.12", - "country": null, - "user_agent": null, - "action_taken": "banned", - "reason": "corpus_ban", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "ip_ban", - "metadata": { - "duration": 3600 - } - }, - { - "event_type": "ip_blocked", - "ip_address": "203.0.113.12", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Banned IP attempted access: 203.0.113.12", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "ip_address": "203.0.113.12", - "filter_type": "banned" - } - } - ] + "expected": [] }, { "id": "evt_ip_ban_failed_escalation", @@ -190,45 +91,7 @@ "body": "" } ], - "expected": [ - { - "event_type": "ip_blocked", - "ip_address": "203.0.113.13", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "IP 203.0.113.13 not in global allowlist/blocklist", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "ip_address": "203.0.113.13", - "filter_type": "global" - } - }, - { - "event_type": "ip_ban_failed", - "ip_address": "203.0.113.13", - "country": null, - "user_agent": null, - "action_taken": "ban_not_applied", - "reason": "Escalation ban failed for 203.0.113.13: corpus injected ban failure", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "ip_address": "203.0.113.13" - } - } - ] + "expected": [] }, { "id": "evt_ip_unbanned", @@ -246,44 +109,7 @@ "ip": "203.0.113.14" } ], - "expected": [ - { - "event_type": "ip_banned", - "ip_address": "203.0.113.14", - "country": null, - "user_agent": null, - "action_taken": "banned", - "reason": "corpus_ban", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "ip_ban", - "metadata": { - "duration": 3600 - } - }, - { - "event_type": "ip_unbanned", - "ip_address": "203.0.113.14", - "country": null, - "user_agent": null, - "action_taken": "unbanned", - "reason": "dynamic_rule_whitelist", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "ip_ban", - "metadata": { - "action": "unban" - } - } - ] + "expected": [] }, { "id": "evt_cloud_blocked_provider", @@ -307,49 +133,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "cloud_blocked", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "IP belongs to blocked cloud provider: AWS", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "cloud", - "metadata": { - "cloud_provider": "AWS", - "network": "203.0.113.0/24" - } - }, - { - "event_type": "decorator_violation", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Cloud provider IP 203.0.113.10 blocked", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": "block_clouds", - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "decorator_type": "block_clouds", - "violation_type": "cloud_provider", - "blocked_providers": [ - "AWS" - ] - } - } - ] + "expected": [] }, { "id": "evt_https_enforced_redirect", @@ -364,27 +148,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "https_enforced", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "https_redirect", - "reason": "HTTP request redirected to HTTPS for security", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "original_scheme": "http", - "redirect_url": "https://example.com" - } - } - ] + "expected": [] }, { "id": "evt_decorator_violation_auth_required", @@ -401,28 +165,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "decorator_violation", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Missing or invalid Bearer token", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": "authentication", - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "decorator_type": "authentication", - "violation_type": "require_auth", - "auth_type": "bearer" - } - } - ] + "expected": [] }, { "id": "evt_behavioral_violation_usage_log", @@ -441,29 +184,7 @@ "details": "Usage threshold exceeded: 5 calls in 60s" } ], - "expected": [ - { - "event_type": "behavioral_violation", - "ip_address": "203.0.113.15", - "country": null, - "user_agent": null, - "action_taken": "log", - "reason": "Behavioral rule violated: Usage threshold exceeded: 5 calls in 60s", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": "usage", - "pattern_matched": null, - "handler_name": "behavior", - "metadata": { - "endpoint": "corpus.endpoint", - "rule_type": "usage", - "threshold": 5, - "window": 60 - } - } - ] + "expected": [] }, { "id": "evt_pattern_detected_xss", @@ -478,39 +199,7 @@ "context": "request_body" } ], - "expected": [ - { - "event_type": "pattern_detected", - "ip_address": "203.0.113.7", - "country": null, - "user_agent": null, - "action_taken": "threat_detected", - "reason": "Threat detected in request_body", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": "]*>[^<]*<\\/script\\s*>", - "handler_name": "sus_patterns", - "metadata": { - "pattern": "]*>[^<]*<\\/script\\s*>", - "context": "request_body", - "content_preview": "", - "threat_score": 1.0, - "threats": 1, - "regex_threats": 1, - "semantic_threats": 0, - "timeouts": 0, - "detection_method": "enhanced", - "correlation_id": null, - "threat_categories": [ - "xss" - ], - "category": "xss" - } - } - ] + "expected": [] }, { "id": "evt_dynamic_rules_update_apply", @@ -530,50 +219,7 @@ } } ], - "expected": [ - { - "event_type": "dynamic_rule_updated", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "rules_received", - "reason": "Received updated rules corpus-rules v7", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "dynamic_rules", - "metadata": { - "rule_id": "corpus-rules", - "version": 7, - "previous_version": 0 - } - }, - { - "event_type": "dynamic_rule_applied", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "rules_updated", - "reason": "Applied dynamic rules corpus-rules v7", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "dynamic_rules", - "metadata": { - "rule_id": "corpus-rules", - "version": 7, - "ip_bans": 0, - "country_blocks": 0, - "emergency_mode": false - } - } - ] + "expected": [] }, { "id": "evt_emergency_mode_activated", @@ -597,71 +243,7 @@ } } ], - "expected": [ - { - "event_type": "dynamic_rule_updated", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "rules_received", - "reason": "Received updated rules corpus-rules v9", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "dynamic_rules", - "metadata": { - "rule_id": "corpus-rules", - "version": 9, - "previous_version": 0 - } - }, - { - "event_type": "emergency_mode_activated", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "emergency_lockdown", - "reason": "[EMERGENCY MODE] activated via dynamic rules", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "dynamic_rules", - "metadata": { - "whitelist_count": 1, - "whitelist": [ - "198.51.100.5" - ] - } - }, - { - "event_type": "dynamic_rule_applied", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "rules_updated", - "reason": "Applied dynamic rules corpus-rules v9", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "dynamic_rules", - "metadata": { - "rule_id": "corpus-rules", - "version": 9, - "ip_bans": 0, - "country_blocks": 0, - "emergency_mode": true - } - } - ] + "expected": [] }, { "id": "evt_access_denied_decorator", @@ -681,27 +263,7 @@ } } ], - "expected": [ - { - "event_type": "access_denied", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "blocked", - "reason": "corpus access denied", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": "access_control", - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "decorator_type": "access_control", - "violation_type": "corpus" - } - } - ] + "expected": [] }, { "id": "evt_authentication_failed_decorator", @@ -720,27 +282,7 @@ } } ], - "expected": [ - { - "event_type": "authentication_failed", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "blocked", - "reason": "corpus auth failed", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": "authentication", - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "decorator_type": "authentication", - "auth_type": "bearer" - } - } - ] + "expected": [] }, { "id": "evt_content_filtered_max_size", @@ -759,27 +301,7 @@ "body": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" } ], - "expected": [ - { - "event_type": "content_filtered", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Request size 64 exceeds limit: 10", - "endpoint": "/upload", - "method": "POST", - "status_code": null, - "decorator_type": "content_filtering", - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "decorator_type": "content_filtering", - "violation_type": "max_request_size" - } - } - ] + "expected": [] }, { "id": "evt_country_blocked_geo", @@ -796,27 +318,7 @@ ] } ], - "expected": [ - { - "event_type": "country_blocked", - "ip_address": "198.51.100.9", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Country CN is blocked", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": "country_blacklist", - "pattern_matched": null, - "handler_name": "ipinfo", - "metadata": { - "country": "CN", - "rule_type": "country_blacklist" - } - } - ] + "expected": [] }, { "id": "evt_csp_violation_report", @@ -835,30 +337,7 @@ } } ], - "expected": [ - { - "event_type": "csp_violation", - "ip_address": "", - "country": null, - "user_agent": null, - "action_taken": "logged", - "reason": "", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "security_headers", - "metadata": { - "document_uri": "https://example.com/page", - "violated_directive": "script-src", - "blocked_uri": "https://evil.example/x.js", - "source_file": "None", - "line_number": null - } - } - ] + "expected": [] }, { "id": "evt_custom_request_check_reject", @@ -873,27 +352,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "custom_request_check", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Custom request check returned blocking response", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "response_status": 418, - "check_function": "corpus_reject_all" - } - } - ] + "expected": [] }, { "id": "evt_decoding_error_unreachable", @@ -918,27 +377,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "emergency_mode_block", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "[EMERGENCY MODE] IP 203.0.113.10 not in whitelist", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "emergency_whitelist_count": 0, - "emergency_active": true - } - } - ] + "expected": [] }, { "id": "evt_geo_lookup_failed_download", @@ -950,24 +389,7 @@ "call": "geo_download_failure" } ], - "expected": [ - { - "event_type": "geo_lookup_failed", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "database_download_failed", - "reason": "Failed to download IPInfo database: RuntimeError", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "ipinfo", - "metadata": {} - } - ] + "expected": [] }, { "id": "evt_path_excluded_health", @@ -985,29 +407,7 @@ "url_path": "/health" } ], - "expected": [ - { - "event_type": "path_excluded", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "security_checks_bypassed", - "reason": "Path /health excluded from security checks", - "endpoint": "/health", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "excluded_path": "/health", - "configured_exclusions": [ - "/health" - ] - } - } - ] + "expected": [] }, { "id": "evt_pattern_added_custom", @@ -1020,28 +420,7 @@ "pattern": "corpuspattern-[a-z]+" } ], - "expected": [ - { - "event_type": "pattern_added", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "pattern_added", - "reason": "Custom pattern added to detection system", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "sus_patterns", - "metadata": { - "pattern": "corpuspattern-[a-z]+", - "pattern_type": "custom", - "total_patterns": 1 - } - } - ] + "expected": [] }, { "id": "evt_pattern_removed_custom", @@ -1054,28 +433,7 @@ "pattern": "corpuspattern-[a-z]+" } ], - "expected": [ - { - "event_type": "pattern_removed", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "pattern_removed", - "reason": "Custom pattern removed from detection system", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "sus_patterns", - "metadata": { - "pattern": "corpuspattern-[a-z]+", - "pattern_type": "custom", - "total_patterns": 0 - } - } - ] + "expected": [] }, { "id": "evt_rate_limited_global", @@ -1095,28 +453,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "rate_limited", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Rate limit exceeded: 2 requests in 60s window", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "rate_limit", - "metadata": { - "request_count": 2, - "rate_limit": 1, - "window": 60 - } - } - ] + "expected": [] }, { "id": "evt_dynamic_rule_violation_endpoint", @@ -1140,49 +477,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "rate_limited", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Rate limit exceeded: 2 requests in 60s window", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "rate_limit", - "metadata": { - "request_count": 2, - "rate_limit": 10, - "window": 60 - } - }, - { - "event_type": "dynamic_rule_violation", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Endpoint-specific rate limit exceeded: 1 requests per 60s for /api", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": "endpoint_rate_limit", - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "rule_type": "endpoint_rate_limit", - "endpoint": "/api", - "rate_limit": 1, - "window": 60 - } - } - ] + "expected": [] }, { "id": "evt_rate_limit_script_reloaded", @@ -1196,24 +491,7 @@ "url_path": "/api" } ], - "expected": [ - { - "event_type": "rate_limit_script_reloaded", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "script_reloaded", - "reason": "NOSCRIPT recovery: Lua script re-cached on Redis", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "rate_limit", - "metadata": {} - } - ] + "expected": [] }, { "id": "evt_redis_connection_established", @@ -1225,26 +503,7 @@ "call": "redis_connect" } ], - "expected": [ - { - "event_type": "redis_connection", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "connection_established", - "reason": "Redis connection successfully established", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "redis", - "metadata": { - "redis_url": "redis://localhost:6379/0" - } - } - ] + "expected": [] }, { "id": "evt_redis_error_connection_failed", @@ -1256,27 +515,7 @@ "call": "redis_connect_error" } ], - "expected": [ - { - "event_type": "redis_error", - "ip_address": "system", - "country": null, - "user_agent": null, - "action_taken": "connection_failed", - "reason": "Redis connection failed: Error Multiple exceptions: [Errno 61] Connect call failed ('::1', 59999, 0, 0), [Errno 61] Connect call failed ('127.0.0.1', 59999) connecting to localhost:59999.", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "redis", - "metadata": { - "redis_url": "redis://localhost:59999/0", - "error_type": "connection_error" - } - } - ] + "expected": [] }, { "id": "evt_route_unresolved_strict", @@ -1292,24 +531,7 @@ "guard_route_unresolved": true } ], - "expected": [ - { - "event_type": "route_unresolved", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "request_blocked", - "reason": "Route resolution failed; per-route decorator config could not be applied", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": {} - } - ] + "expected": [] }, { "id": "evt_security_bypass_all", @@ -1329,29 +551,7 @@ "url_path": "/open" } ], - "expected": [ - { - "event_type": "security_bypass", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": null, - "action_taken": "all_checks_bypassed", - "reason": "Route configured to bypass all security checks", - "endpoint": "/open", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "bypassed_checks": [ - "all" - ], - "endpoint": "/open" - } - } - ] + "expected": [] }, { "id": "evt_security_headers_applied_default", @@ -1364,29 +564,7 @@ "path": "/api" } ], - "expected": [ - { - "event_type": "security_headers_applied", - "ip_address": "", - "country": null, - "user_agent": null, - "action_taken": "headers_added", - "reason": "", - "endpoint": null, - "method": null, - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "security_headers", - "metadata": { - "path": "/api", - "headers_count": 11, - "has_csp": false, - "has_hsts": true - } - } - ] + "expected": [] }, { "id": "evt_user_agent_blocked_global", @@ -1406,27 +584,7 @@ } } ], - "expected": [ - { - "event_type": "user_agent_blocked", - "ip_address": "203.0.113.10", - "country": null, - "user_agent": "evilbot/1.0", - "action_taken": "request_blocked", - "reason": "User agent 'evilbot/1.0' in global blocklist", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "middleware", - "metadata": { - "user_agent": "evilbot/1.0", - "filter_type": "global" - } - } - ] + "expected": [] }, { "id": "evt_suspicious_request_untrusted_proxy", @@ -1447,24 +605,7 @@ "drop_cached_client_ip": true } ], - "expected": [ - { - "event_type": "suspicious_request", - "ip_address": "203.0.113.17", - "country": null, - "user_agent": null, - "action_taken": "spoofing_detected", - "reason": "Potential IP spoof attempt: X-Forwarded-For header 198.51.100.77", - "endpoint": "/api", - "method": "GET", - "status_code": null, - "decorator_type": null, - "rule_type": null, - "pattern_matched": null, - "handler_name": "ip_extraction", - "metadata": {} - } - ] + "expected": [] }, { "id": "evt_detection_engine_callback_error", diff --git a/conformance/guard-core-spec-4.1.0/cases/inclusion_sensitive_recon.json b/conformance/guard-core-spec-4.1.0/cases/inclusion_sensitive_recon.json index 8228aec..1250114 100644 --- a/conformance/guard-core-spec-4.1.0/cases/inclusion_sensitive_recon.json +++ b/conformance/guard-core-spec-4.1.0/cases/inclusion_sensitive_recon.json @@ -2,7 +2,7 @@ "suite": "inclusion_sensitive_recon", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "incl_php_filter", diff --git a/conformance/guard-core-spec-4.1.0/cases/index.json b/conformance/guard-core-spec-4.1.0/cases/index.json index 99d61bc..ccf5a4d 100644 --- a/conformance/guard-core-spec-4.1.0/cases/index.json +++ b/conformance/guard-core-spec-4.1.0/cases/index.json @@ -1,8 +1,8 @@ { "spec_version": "4.1.0", - "engine_version": "4.2.0", - "engine_commit": "13436664e53e7329d5f2587a01ddb9a0fd95873f", - "generated_at": "2026-10-01T02:02:25.923544+00:00", + "engine_version": "4.3.2", + "engine_commit": "58957987b677d1e06930347443df7c8394758ea7", + "generated_at": "2026-10-10T14:39:35.908173+00:00", "fixed_ip": "203.0.113.7", "config_knobs": { "detection_compiler_timeout": 2.0, @@ -228,9 +228,9 @@ "rust" ] }, - "safety_gates": { - "case_count": 94, - "kind": "pattern_safety", + "cost_bodies": { + "case_count": 9, + "kind": "detect", "consumers": [ "python", "go", @@ -239,15 +239,16 @@ "rust" ] }, - "cost_bodies": { - "case_count": 9, - "kind": "detect", + "safety_gates": { + "case_count": 94, + "kind": "pattern_safety", "consumers": [ "python", "go", "php", "ts", - "rust" + "rust", + "jvm" ] } }, @@ -274,42 +275,42 @@ "k": 5, "floor_ms": 250, "timing_runs": 5, - "generated_at": "2026-10-05T10:02:47+00:00", + "generated_at": "2026-10-10T14:40:11+00:00", "budgets": { "cost_prose_8kib": { - "reference_ms": 25.8, + "reference_ms": 26.8, "expected_is_threat": false }, "cost_prose_64kib": { - "reference_ms": 176.4, + "reference_ms": 182.2, "expected_is_threat": false }, "cost_prose_256kib": { - "reference_ms": 683.0, + "reference_ms": 717.9, "expected_is_threat": false }, "cost_prose_1mib": { - "reference_ms": 1218.2, + "reference_ms": 1238.6, "expected_is_threat": false }, "cost_encoded_64kib": { - "reference_ms": 145.9, + "reference_ms": 153.7, "expected_is_threat": false }, "cost_binnoise_64kib": { - "reference_ms": 196.1, + "reference_ms": 205.8, "expected_is_threat": false }, "cost_threat_8kib": { - "reference_ms": 25.5, + "reference_ms": 26.9, "expected_is_threat": true }, "cost_threat_tail_256kib": { - "reference_ms": 676.2, + "reference_ms": 714.5, "expected_is_threat": true }, "cost_threat_mid_1mib": { - "reference_ms": 1205.6, + "reference_ms": 1242.5, "expected_is_threat": false } } diff --git a/conformance/guard-core-spec-4.1.0/cases/misc_injection.json b/conformance/guard-core-spec-4.1.0/cases/misc_injection.json index 4e9ad4a..70b9eff 100644 --- a/conformance/guard-core-spec-4.1.0/cases/misc_injection.json +++ b/conformance/guard-core-spec-4.1.0/cases/misc_injection.json @@ -2,7 +2,7 @@ "suite": "misc_injection", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "log4shell_jndi_ldap", diff --git a/conformance/guard-core-spec-4.1.0/cases/path_traversal.json b/conformance/guard-core-spec-4.1.0/cases/path_traversal.json index 7aa9dfd..0f2aba0 100644 --- a/conformance/guard-core-spec-4.1.0/cases/path_traversal.json +++ b/conformance/guard-core-spec-4.1.0/cases/path_traversal.json @@ -2,7 +2,7 @@ "suite": "path_traversal", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "trav_double_dot_slash", diff --git a/conformance/guard-core-spec-4.1.0/cases/pipeline_behavior_rules.json b/conformance/guard-core-spec-4.1.0/cases/pipeline_behavior_rules.json index 31f3d67..3dc44dc 100644 --- a/conformance/guard-core-spec-4.1.0/cases/pipeline_behavior_rules.json +++ b/conformance/guard-core-spec-4.1.0/cases/pipeline_behavior_rules.json @@ -2,7 +2,7 @@ "suite": "pipeline_behavior_rules", "kind": "pipeline", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "return_pattern_rule_bans_after_threshold", diff --git a/conformance/guard-core-spec-4.1.0/cases/pipeline_detection_response.json b/conformance/guard-core-spec-4.1.0/cases/pipeline_detection_response.json index 90d0a7e..696d3e8 100644 --- a/conformance/guard-core-spec-4.1.0/cases/pipeline_detection_response.json +++ b/conformance/guard-core-spec-4.1.0/cases/pipeline_detection_response.json @@ -2,7 +2,7 @@ "suite": "pipeline_detection_response", "kind": "pipeline", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "attack_blocked_400_contract_body", diff --git a/conformance/guard-core-spec-4.1.0/cases/pipeline_headers_cors.json b/conformance/guard-core-spec-4.1.0/cases/pipeline_headers_cors.json index 51c02c7..f54d7ac 100644 --- a/conformance/guard-core-spec-4.1.0/cases/pipeline_headers_cors.json +++ b/conformance/guard-core-spec-4.1.0/cases/pipeline_headers_cors.json @@ -2,7 +2,7 @@ "suite": "pipeline_headers_cors", "kind": "pipeline", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "error_response_carries_default_security_headers", diff --git a/conformance/guard-core-spec-4.1.0/cases/pipeline_ip_control.json b/conformance/guard-core-spec-4.1.0/cases/pipeline_ip_control.json index ae907f1..ddef3a8 100644 --- a/conformance/guard-core-spec-4.1.0/cases/pipeline_ip_control.json +++ b/conformance/guard-core-spec-4.1.0/cases/pipeline_ip_control.json @@ -2,7 +2,7 @@ "suite": "pipeline_ip_control", "kind": "pipeline", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "ip_blacklist_forbidden", diff --git a/conformance/guard-core-spec-4.1.0/cases/pipeline_rate_limits.json b/conformance/guard-core-spec-4.1.0/cases/pipeline_rate_limits.json index 391e61e..6f4659c 100644 --- a/conformance/guard-core-spec-4.1.0/cases/pipeline_rate_limits.json +++ b/conformance/guard-core-spec-4.1.0/cases/pipeline_rate_limits.json @@ -2,7 +2,7 @@ "suite": "pipeline_rate_limits", "kind": "pipeline", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "global_limit_429_with_retry_after", diff --git a/conformance/guard-core-spec-4.1.0/cases/redis_interop.json b/conformance/guard-core-spec-4.1.0/cases/redis_interop.json index aa70598..b4c3e3e 100644 --- a/conformance/guard-core-spec-4.1.0/cases/redis_interop.json +++ b/conformance/guard-core-spec-4.1.0/cases/redis_interop.json @@ -2,7 +2,7 @@ "suite": "redis_interop", "kind": "redis_interop", "spec_version": "4.1.0", - "engine_version": "4.2.0", + "engine_version": "4.3.2", "doc": "Byte-level Redis interop corpus per specs/08-redis-schema.md: one operation per key family against the reference handlers pointed at a real Redis under the suite prefix. Byte equality is the standard: the pinned key string (sha256hex segments per spec), the exact stored value for static values, the member/score shape for zsets (members are engine-generated where noted), the parsed-then-canonicalized JSON blob with volatile fields dropped, and the TTL semantics (whether a TTL is set and its configured value, never the remaining time). Go, PHP, TS and Rust ports pointed at the same Redis MUST produce byte-identical results.", "cases": [ { diff --git a/conformance/guard-core-spec-4.1.0/cases/safety_gates.json b/conformance/guard-core-spec-4.1.0/cases/safety_gates.json index d3ba703..12b4239 100644 --- a/conformance/guard-core-spec-4.1.0/cases/safety_gates.json +++ b/conformance/guard-core-spec-4.1.0/cases/safety_gates.json @@ -2,7 +2,7 @@ "suite": "safety_gates", "kind": "pattern_safety", "spec_version": "4.1.0", - "engine_version": "4.2.0", + "engine_version": "4.3.2", "cases": [ { "id": "safety_test_strings_safe_01", diff --git a/conformance/guard-core-spec-4.1.0/cases/semantic.json b/conformance/guard-core-spec-4.1.0/cases/semantic.json index 14aa7dd..4bd4b68 100644 --- a/conformance/guard-core-spec-4.1.0/cases/semantic.json +++ b/conformance/guard-core-spec-4.1.0/cases/semantic.json @@ -2,7 +2,7 @@ "suite": "semantic", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "sem_structural_dense", diff --git a/conformance/guard-core-spec-4.1.0/cases/sqli.json b/conformance/guard-core-spec-4.1.0/cases/sqli.json index 2221c44..b2fb9a9 100644 --- a/conformance/guard-core-spec-4.1.0/cases/sqli.json +++ b/conformance/guard-core-spec-4.1.0/cases/sqli.json @@ -2,7 +2,7 @@ "suite": "sqli", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "sqli_or_tautology", diff --git a/conformance/guard-core-spec-4.1.0/cases/xss.json b/conformance/guard-core-spec-4.1.0/cases/xss.json index bdb43b8..18f8260 100644 --- a/conformance/guard-core-spec-4.1.0/cases/xss.json +++ b/conformance/guard-core-spec-4.1.0/cases/xss.json @@ -2,7 +2,7 @@ "suite": "xss", "kind": "detect", "spec_version": "4.1.0", - "engine_version": "4.1.0", + "engine_version": "4.3.2", "cases": [ { "id": "xss_script_alert", diff --git a/conformance/guard-core-spec-4.1.0/php_events_xfail.json b/conformance/guard-core-spec-4.1.0/php_events_xfail.json index 0a6edc1..5df40ef 100644 --- a/conformance/guard-core-spec-4.1.0/php_events_xfail.json +++ b/conformance/guard-core-spec-4.1.0/php_events_xfail.json @@ -1,38 +1,35 @@ { "spec_version": "4.1.0", - "_comment": "Documented divergences of the PHP event surface against the reference event_stream corpus (comparison block events_envelopes: expected keys only, volatile fields dropped recursively, absent fields recorded as null). Fail-closed: a failing case NOT listed here is red; a listed case that now passes is red (stale baseline); a case with no driver that is NOT listed is red. Root causes: (1) the reference's handler-level emitters (sus_patterns, ip_ban envelopes, security_headers, redis manager, ip extraction, decorators, dynamic-rule violation events) are not ported or are expressed as adapter seams without envelopes; (2) PHP block events ride the check pipeline bus (SecurityCheckPipeline::fireBlockHook) so their reasons are the on_block log-format strings and their metadata is the check-hook shape (check_name/trigger_info/status_code) instead of the reference's per-event metadata; (3) SecurityCheckPipeline::blockEventType maps only the eight pipeline check families, so blocks outside that map fall to the default penetration_attempt type.", + "_comment": "Documented divergences of the PHP event surface against the reference event_stream corpus (comparison block events_envelopes: expected keys only, volatile fields dropped recursively, absent fields recorded as null). Fail-closed: a failing case NOT listed here is red; a listed case that now passes is red (stale baseline); a case with no driver that is NOT listed is red. Root causes: (1) the reference's handler-level emitters (sus_patterns, ip_ban envelopes, security_headers, redis manager, ip extraction, decorators, dynamic-rule violation events) are not ported or are expressed as adapter seams without envelopes; (2) PHP block events ride the check pipeline bus (SecurityCheckPipeline::fireBlockHook) so their reasons are the on_block log-format strings and their metadata is the check-hook shape (check_name/trigger_info/status_code) instead of the reference's per-event metadata; (3) SecurityCheckPipeline::blockEventType maps only the eight pipeline check families, so blocks outside that map fall to the default penetration_attempt type. 4.3.2 corpus regen note: the reference generation environment does not have the optional guard_agent module installed, and the reference engine builds every middleware-bus SecurityEvent through guard_core._pydantic_plugin_mute.get_telemetry_model('SecurityEvent'), which imports guard_agent, so the construction fails closed and the reference capture harness recorded ZERO envelopes for every bus-emitted scenario; the corpus therefore pins expected: [] for them (verified live against the reference engine, which still captures 0 events for these cases). Two consequences, both applied in this ledger update: (a) the scenarios where the port emits nothing anyway now compare 0 against 0 and PASS, so five stale entries were removed (evt_behavioral_violation_usage_log, evt_ip_unbanned, evt_path_excluded_health, evt_pattern_detected_xss, evt_security_bypass_all) - their documented port gaps are unchanged but no longer produce a diff under this corpus revision; those passes ride on the corpus artifact, and a corpus regen with guard_agent installed will pin real envelopes again and resurface them as failures needing entries; (b) the scenarios where the port DOES emit (country_blocked, geo_lookup_failed) now diverge at count level against the zero pins and gained entries. If the corpus regenerates with guard_agent installed, every entry tied to a zero pin must be re-evaluated (stale entries are red by policy).", "cases": { - "evt_penetration_attempt_blocked": "The PHP pipeline classifies the body XSS block under the suspicious_activity check, so SecurityCheckPipeline::blockEventType maps it to suspicious_request with the check-hook metadata shape (fireBlockHook); the reference emits penetration_attempt with request_count/trigger_info metadata.", - "evt_penetration_attempt_passive": "PHP passive mode returns the request without a block response, so SecurityCheckPipeline::fireBlockHook never runs and the bus emits nothing; the reference's passive dispatch emits a logged_only penetration_attempt.", - "evt_ip_blocked_global_blacklist": "The PHP bus reason is the composed log format 'IP not allowed: - ' and the metadata is the check-hook shape (SecurityCheckPipeline::fireBlockHook); the reference envelope carries the bare detail reason with filter_type metadata.", - "evt_ip_banned_then_blocked": "The engine emits only the ip_blocked envelope: the ban-time event is an adapter-authored BanEventSink call (src/Ban/BanEventSink.php) carrying just (ip, duration, reason), so the corpus ip_banned envelope (handler ip_ban, metadata.duration) has no in-engine emitter.", - "evt_ip_ban_failed_escalation": "No PHP seam: the corpus ipban_fault injection has no analogue (IpBanManager has no raisable ban hook), and no PHP source emits ip_ban_failed anywhere.", - "evt_ip_unbanned": "No in-engine emitter: the unban-time event is an adapter-authored BanEventSink call (src/Ban/BanEventSink.php) with no envelope, so neither ip_banned nor ip_unbanned envelopes are observable.", - "evt_cloud_blocked_provider": "The pipeline emits the cloud_blocked envelope but no decorator_violation: route-level decorator events (handler middleware, decorator_type block_clouds) are not ported; the port's cloud block surfaces only through the check pipeline.", - "evt_https_enforced_redirect": "EventBus::sendHttpsViolationEvent builds the https_enforced envelope but no engine code calls it: the enforce_https redirect returns through the check pipeline, so the emit falls to the default block mapping (penetration_attempt) with check-hook metadata.", - "evt_decorator_violation_auth_required": "The PHP authentication check emits authentication_failed with the prefixed log reason 'Authentication failure: ...' and check-hook metadata; no PHP emitter carries the reference decorator_violation envelope's decorator_type metadata.", - "evt_behavioral_violation_usage_log": "Documented port gap (src/Behavior/BehaviorTracker.php, applyAction): the reference's behavioral_violation agent event is not modeled; the action dispatch logs only.", - "evt_pattern_detected_xss": "SusPatterns::detect returns the detection result and emits no agent envelope; the reference sus_patterns_handler's pattern_detected emitter has no PHP analogue.", - "evt_dynamic_rules_update_apply": "DynamicRuleManager::sendRuleEvent emits through the middleware bus (handler middleware, reason 'Dynamic rules v', method SYSTEM), not the reference dynamic_rules handler envelope (reason 'Received/Applied updated rules ...', ip system, previous_version metadata).", - "evt_emergency_mode_activated": "The PHP DynamicRuleManager emits dynamic_rule_updated/applied but has no emergency_mode_activated emitter; the emergency lockdown path logs only.", - "evt_access_denied_decorator": "No PHP seam: the reference BaseSecurityDecorator send_access_denied_event emitter has no port; the bus carries only the require_https decorator pair.", - "evt_authentication_failed_decorator": "No PHP seam for the decorator send_authentication_failed_event emitter; the PHP authentication_failed envelope comes only from the pipeline block mapping, which cannot carry injected decorator kwargs.", - "evt_content_filtered_max_size": "The request_size_content check blocks the oversized request with the reference reason ('Request size 64 exceeds limit: 10'), but SecurityCheckPipeline::blockEventType has no content-filtering mapping (the block falls to the default penetration_attempt) and no emitter carries the content_filtered decorator metadata.", - "evt_csp_violation_report": "No PHP seam: SecurityHeadersPolicy computes header maps only; the reference security_headers_manager's validate_csp_report / csp_violation agent event is not ported.", - "evt_custom_request_check_reject": "The custom_request check blocks with the injected 418 response, but SecurityCheckPipeline::blockEventType maps custom_request to the default penetration_attempt and the bus reason is the generic 'Request blocked'; the reference emits custom_request_check with response_status/check_function metadata.", - "evt_emergency_mode_block": "The PHP emergency_mode check reason is the log-format '[EMERGENCY MODE] Access denied for IP ' with check-hook metadata; the reference envelope reason is '[EMERGENCY MODE] IP not in whitelist' with emergency metadata.", - "evt_path_excluded_health": "Excluded paths skip the request silently through the pipeline's exclusion scope; no path_excluded emitter exists in the port.", - "evt_pattern_added_custom": "No PHP seam: SusPatterns carries no custom-pattern registry surface, so no pattern_added envelope exists.", - "evt_pattern_removed_custom": "No PHP seam: SusPatterns carries no custom-pattern registry surface, so no pattern_removed envelope exists.", - "evt_rate_limited_global": "The PHP rate-limit block reason is the composed log format 'Rate limit exceeded for IP: (N requests in Ws window)' and the emit rides the middleware handler with check-hook metadata; the reference envelope carries the bare 'Rate limit exceeded: ...' reason with a rate_limit handler and request_count metadata.", - "evt_dynamic_rule_violation_endpoint": "The PHP endpoint-tier block emits rate_limited only; the reference's dynamic_rule_violation middleware emit for endpoint-specific limits has no PHP emitter.", - "evt_rate_limit_script_reloaded": "No envelope seam: the RateLimitHandler NOSCRIPT recovery reloads the script silently (src/RateLimit/RateLimitHandler.php) and its onScriptReloaded callback carries no envelope; the reference's rate_limit_script_reloaded agent event is not emitted.", - "evt_redis_connection_established": "No PHP seam: the port's RedisHandler has no manager-level agent surface; the reference RedisManager emits redis_connection from initialize.", - "evt_redis_error_connection_failed": "No PHP seam: the port's RedisHandler has no manager-level agent surface; the reference RedisManager emits redis_error from a failed initialize.", - "evt_route_unresolved_strict": "No PHP emitter: routeResolutionStrict parses into SecurityConfig but no engine code consumes it, so the reference's route_unresolved emit has no analogue.", - "evt_security_bypass_all": "PHP bypassed_checks short-circuits the pipeline silently; no security_bypass emitter exists in the port.", + "evt_penetration_attempt_blocked": "The PHP pipeline classifies the body XSS block under the suspicious_activity check, so SecurityCheckPipeline::blockEventType maps it to suspicious_request with the check-hook metadata shape (fireBlockHook); the reference emits penetration_attempt with request_count/trigger_info metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (suspicious_request, security_headers_applied).", + "evt_penetration_attempt_passive": "PHP passive mode returns the request without a block response, so SecurityCheckPipeline::fireBlockHook never runs and the bus emits nothing for the block; the reference's passive dispatch emits a logged_only penetration_attempt. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 1 (security_headers_applied).", + "evt_ip_blocked_global_blacklist": "The PHP bus reason is the composed log format 'IP not allowed: - ' and the metadata is the check-hook shape (SecurityCheckPipeline::fireBlockHook); the reference envelope carries the bare detail reason with filter_type metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (ip_blocked, security_headers_applied).", + "evt_ip_banned_then_blocked": "The engine emits only the ip_blocked envelope: the ban-time event is an adapter-authored BanEventSink call (src/Ban/BanEventSink.php) carrying just (ip, duration, reason), so the corpus ip_banned envelope (handler ip_ban, metadata.duration) has no in-engine emitter. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (ip_blocked, security_headers_applied).", + "evt_ip_ban_failed_escalation": "No PHP seam: the corpus ipban_fault injection has no analogue (IpBanManager has no raisable ban hook), and no PHP source emits ip_ban_failed anywhere; the runner's driver throws for the corpus call.", + "evt_cloud_blocked_provider": "The pipeline emits the cloud_blocked envelope but no decorator_violation: route-level decorator events (handler middleware, decorator_type block_clouds) are not ported; the port's cloud block surfaces only through the check pipeline. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 4 (cloud_blocked, decorator_violation, cloud_blocked, security_headers_applied).", + "evt_https_enforced_redirect": "EventBus::sendHttpsViolationEvent builds the https_enforced envelope but no engine code calls it: the enforce_https redirect returns through the check pipeline, so the emit falls to the default block mapping (penetration_attempt) with check-hook metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (penetration_attempt, security_headers_applied).", + "evt_decorator_violation_auth_required": "No PHP seam for the decorator send_authentication_failed_event emitter; the PHP authentication_failed envelope comes only from the pipeline block mapping, which cannot carry injected decorator kwargs; the runner's driver throws for the corpus decorator_event call.", + "evt_access_denied_decorator": "No PHP seam: the reference BaseSecurityDecorator send_access_denied_event emitter has no port; the bus carries only the require_https decorator pair; the runner's driver throws for the corpus decorator_event call.", + "evt_authentication_failed_decorator": "No PHP seam for the decorator send_authentication_failed_event emitter; the PHP authentication_failed envelope comes only from the pipeline block mapping, which cannot carry injected decorator kwargs; the runner's driver throws for the corpus decorator_event call.", + "evt_content_filtered_max_size": "The request_size_content check blocks the oversized request with the reference reason ('Request size 64 exceeds limit: 10'), but SecurityCheckPipeline::blockEventType has no content-filtering mapping (the block falls to the default penetration_attempt) and no emitter carries the content_filtered decorator metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (penetration_attempt, security_headers_applied).", + "evt_country_blocked_geo": "Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes for this scenario because the reference generation environment lacks the optional guard_agent module (reference bus event construction fails closed, so the capture harness recorded zero); the port's geo_country_stub driver emits 1 country_blocked envelope through its own bus, so the runner sees got 1 want 0.", + "evt_geo_lookup_failed_download": "Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes for this scenario because the reference generation environment lacks the optional guard_agent module (reference bus event construction fails closed, so the capture harness recorded zero); the port's geo_download_failure driver emits 1 geo_lookup_failed envelope through its own bus, so the runner sees got 1 want 0.", + "evt_csp_violation_report": "No PHP seam: SecurityHeadersPolicy computes header maps only; the reference security_headers_manager's validate_csp_report / csp_violation agent event is not ported; the runner's driver throws for the corpus csp_report call.", + "evt_custom_request_check_reject": "The custom_request check blocks with the injected 418 response, but SecurityCheckPipeline::blockEventType maps custom_request to the default penetration_attempt and the bus reason is the generic 'Request blocked'; the reference emits custom_request_check with response_status/check_function metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (penetration_attempt, security_headers_applied).", + "evt_emergency_mode_block": "The PHP emergency_mode check reason is the log-format '[EMERGENCY MODE] Access denied for IP ' with check-hook metadata; the reference envelope reason is '[EMERGENCY MODE] IP not in whitelist' with emergency metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (emergency_mode_block, security_headers_applied).", + "evt_pattern_added_custom": "No PHP seam: SusPatterns carries no custom-pattern registry surface, so no pattern_added envelope exists; the runner's driver throws for the corpus add_pattern call.", + "evt_pattern_removed_custom": "No PHP seam: SusPatterns carries no custom-pattern registry surface, so no pattern_removed envelope exists; the runner's driver throws for the corpus remove_pattern call.", + "evt_rate_limited_global": "The PHP rate-limit block reason is the composed log format 'Rate limit exceeded for IP: (N requests in Ws window)' and the emit rides the middleware handler with check-hook metadata; the reference envelope carries the bare 'Rate limit exceeded: ...' reason with a rate_limit handler and request_count metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (security_headers_applied, rate_limited).", + "evt_dynamic_rule_violation_endpoint": "The PHP endpoint-tier block emits rate_limited only; the reference's dynamic_rule_violation middleware emit for endpoint-specific limits has no PHP emitter. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (security_headers_applied, rate_limited).", + "evt_rate_limit_script_reloaded": "No envelope seam: the RateLimitHandler NOSCRIPT recovery reloads the script silently (src/RateLimit/RateLimitHandler.php) and its onScriptReloaded callback carries no envelope; the reference's rate_limit_script_reloaded agent event is not emitted; the runner's driver throws for the corpus rate_limit_script_reload call.", + "evt_dynamic_rules_update_apply": "DynamicRuleManager::sendRuleEvent emits through the middleware bus (handler middleware, reason 'Dynamic rules v', method SYSTEM), not the reference dynamic_rules handler envelope (reason 'Received/Applied updated rules ...', ip system, previous_version metadata). Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (dynamic_rule_updated, dynamic_rule_applied).", + "evt_emergency_mode_activated": "The PHP DynamicRuleManager emits dynamic_rule_updated/applied but has no emergency_mode_activated emitter; the emergency lockdown path logs only. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (dynamic_rule_updated, dynamic_rule_applied).", + "evt_redis_connection_established": "No PHP seam: the port's RedisHandler has no manager-level agent surface; the reference RedisManager emits redis_connection from initialize; the runner's driver throws for the corpus redis_connect call.", + "evt_redis_error_connection_failed": "No PHP seam: the port's RedisHandler has no manager-level agent surface; the reference RedisManager emits redis_error from a failed initialize; the runner's driver throws for the corpus redis_connect_error call.", + "evt_route_unresolved_strict": "No PHP emitter: routeResolutionStrict parses into SecurityConfig but no engine code consumes it, so the reference's route_unresolved emit has no analogue. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 1 (security_headers_applied).", "evt_security_headers_applied_default": "No driver and no emitter: the port's SecurityHeadersPolicy computes headers on demand with no agent surface (KNOWN_GAPS, security headers management); the reference's headers_applied event is not emitted.", - "evt_user_agent_blocked_global": "The PHP user-agent block reason is the composed log format 'Blocked user agent: ' with check-hook metadata; the reference envelope reason is \"User agent '' in global blocklist\" with filter_type metadata.", - "evt_suspicious_request_untrusted_proxy": "No PHP seam: extracting a client IP behind an untrusted proxy emits nothing in the port; the reference's ip_extraction spoofing seam in extract_client_ip has no analogue." + "evt_user_agent_blocked_global": "The PHP user-agent block reason is the composed log format 'Blocked user agent: ' with check-hook metadata; the reference envelope reason is \"User agent '' in global blocklist\" with filter_type metadata. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 2 (user_agent_blocked, security_headers_applied).", + "evt_suspicious_request_untrusted_proxy": "No PHP seam: extracting a client IP behind an untrusted proxy emits nothing in the port; the reference's ip_extraction spoofing seam in extract_client_ip has no analogue. Under the 4.3.2 corpus the divergence is count-level: the corpus pins 0 envelopes (reference bus event construction fails closed without the optional guard_agent module in the generation environment) while the port emits 1 (security_headers_applied)." } }