fix(detection): port the verified guard-core reference fixes (passive log reason, semantic header opt-out, Cookie pair scan)

crates/guard-core-conformance/src/pipeline.rs

@@ -418,6 +418,7 @@ impl CaseEngine {
                 excluded_detection_body_fields: list_at("excluded_detection_body_fields"),
                 enabled_detection_categories: None,
                 detection_scan_body: None,
+                ..RouteDetectionExclusions::default()
             };
             let exclusions = if overrides.get("excluded_detection_headers").is_some()
                 || overrides.get("excluded_detection_params").is_some()

crates/guard-core-engine/src/decorators.rs

@@ -555,8 +555,10 @@ impl SecurityDecorator {
         self
     }
 
-    /// `@detection_exclusion`: the route's five detection knobs; every
-    /// `None` leaves that knob untouched.
+    /// `@detection_exclusion`: the route's six detection knobs; every
+    /// `None` leaves that knob untouched. `semantic_headers` adds header
+    /// names whose values skip the semantic analyzer only.
+    #[allow(clippy::too_many_arguments)]
     pub fn detection_exclusion(
         &mut self,
         route_id: &str,
@@ -565,9 +567,11 @@ impl SecurityDecorator {
         body_fields: Option<BTreeSet<String>>,
         categories: Option<BTreeSet<String>>,
         scan_body: Option<bool>,
+        semantic_headers: Option<BTreeSet<String>>,
     ) -> &mut Self {
         let present = [
             headers.is_some(),
+            semantic_headers.is_some(),
             params.is_some(),
             body_fields.is_some(),
             categories.is_some(),
@@ -580,6 +584,9 @@ impl SecurityDecorator {
         if let Some(headers) = headers {
             route.excluded_detection_headers = Some(headers);
         }
+        if let Some(semantic_headers) = semantic_headers {
+            route.excluded_semantic_detection_headers = Some(semantic_headers);
+        }
         if let Some(params) = params {
             route.excluded_detection_params = Some(params);
         }
@@ -1125,8 +1132,13 @@ mod tests {
             None,
             Some(BTreeSet::from([String::from("xss")])),
             Some(false),
+            Some(BTreeSet::from([String::from("cookie")])),
         );
         let route = decorator.get_route_config("POST /scan-me").expect("route");
+        assert_eq!(
+            route.excluded_semantic_detection_headers,
+            Some(BTreeSet::from([String::from("cookie")]))
+        );
         assert_eq!(
             route.excluded_detection_headers,
             Some(BTreeSet::from([String::from("x-api-key")]))
@@ -1177,6 +1189,7 @@ mod tests {
             Some(BTreeSet::from([String::from("password")])),
             None,
             None,
+            None,
         );
         let route = decorator.get_route_config("POST /scan-me").expect("route");
         assert_eq!(

crates/guard-core-engine/src/detect.rs

@@ -227,6 +227,21 @@ fn semantic_threats(
 /// The reference `detect` pipeline over one request content.
 #[must_use]
 pub fn detect(content: &str, request_context: &str, config: &DetectConfig) -> DetectVerdict {
+    detect_with_semantic_skip(content, request_context, config, false)
+}
+
+/// [`detect`] with the semantic analyzer optionally skipped.
+///
+/// The reference `_context_header_is_semantic_excluded`: the regex passes
+/// still run on the value, only the semantic threats are left out. The
+/// opt-in `excluded_semantic_detection_headers` path.
+#[must_use]
+pub fn detect_with_semantic_skip(
+    content: &str,
+    request_context: &str,
+    config: &DetectConfig,
+    skip_semantic: bool,
+) -> DetectVerdict {
     let original_length = content.chars().count();
     let (processed, decoded, decode_budget_exhausted) = preprocessor::preprocess_with_decoded(
         content,
@@ -307,7 +322,11 @@ pub fn detect(content: &str, request_context: &str, config: &DetectConfig) -> De
         ));
     }
 
-    let semantic = semantic_threats(&processed, content, config);
+    let semantic = if skip_semantic {
+        Vec::new()
+    } else {
+        semantic_threats(&processed, content, config)
+    };
 
     let anomaly = regex_anomaly(&regex_threats);
     let is_threat = anomaly >= config.threat_score_threshold || !semantic.is_empty();