augure 0.1.0

data/home/runner/work/augure/augure/lib/augure/pipeline.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Augure
+  # The pipeline facade: facts -> engine -> bandit -> MCTS -> decision.
+  # Augure decides; it never executes. The returned hash is the audit
+  # payload: applicable, verified, selected, plan and the per-technique
+  # rule provenance.
+  module Pipeline
+    module_function
+
+    # Decide on a fact base and return the auditable decision.
+    #
+    # @param facts [String, Facts] raw fact text or a parsed fact base
+    # @param seed [Integer, nil] seed for deterministic bandit/MCTS draws
+    # @param priors [Hash{String => [Numeric, Numeric]}, nil] prior table
+    #   overriding the AG+EXTENDED+KB defaults (see Priors.from_trail
+    #   usage in lictor for the closed loop)
+    # @param buffer_size [Integer] stack budget for payload-fit checks
+    # @return [Hash] the decision:
+    #   {applicable:, verified:, ranking:, selected:, plan:, explain:}
+    #   The --json payload is the same hash stamped with
+    #   "schema": "augure/decision@1" (stable contract).
+    # The verify layer is the ARITHMETIC feasibility check
+    # (Verifier.payload_fits). The SMT path is a separate, tested seam
+    # (Verifier.payload_fits_smtlib + SmtProcess) wired by consumers who
+    # need it - the pipeline does not run a solver behind the scenes.
+    # plan: false skips the MCTS search (the corpus guard needs only the
+    # deterministic applicable + prior-mean ranking; MCTS is the costly part).
+    def analyze(facts:, seed: nil, priors: nil, buffer_size: 256, packs: nil, plan: true)
+      facts = Facts.parse(facts) if facts.is_a?(String)
+      engine_rules = packs ? Rules.all + packs.flat_map(&:rules) : Rules.all
+      effective_priors = PackLoader.priors_with(packs, priors || default_priors)
+      engine_result = Engine.new(facts, rules: engine_rules).run
+      applicable = engine_result.applicable
+
+      verified = verify(applicable, facts: facts, buffer_size: buffer_size)
+
+      # The seed drives the WHOLE draw, selection included: a decision
+      # replayed with the same seed must select the same technique.
+      bandit = selector(priors: effective_priors, rng: seed ? Random.new(seed) : nil)
+      ranking = bandit.ranking_of(applicable)
+      candidates = verified.select { |_, v| v[:status] == :sat }.keys
+      selected = bandit.select(candidates.empty? ? applicable : candidates)
+      plan = plan ? plan_for(applicable, seed: seed, packs: packs) : []
+
+      {
+        applicable: applicable,
+        verified: verified,
+        ranking: ranking.map(&:first),
+        selected: selected,
+        plan: plan,
+        explain: {provenance: explain_provenance(engine_result)}
+      }
+    end
+
+    # The explain payload: per applicable technique, the rules that
+    # fired it with their evidence (the audit contract).
+    def explain_provenance(engine_result)
+      heads = engine_result.provenance_by_head.select { |head, _| head[0] == Rules::APPLICABLE }
+      heads.transform_keys { |head| head[1] }.transform_values do |provs|
+        provs.map do |p|
+          {rule: p[:rule], evidence: p[:evidence], origin: p[:origin]}
+        end
+      end
+    end
+
+    # The selector every consumer shares: AG inversions + KB-informed priors.
+    def selector(priors: nil, rng: nil)
+      Bandit.new(priors: priors || default_priors, rng: rng || Random.new)
+    end
+
+    def default_priors
+      @default_priors ||= begin
+        # Disjoint by design: EXTENDED_PRIORS covers techniques the AG
+        # simulation never scored.
+        merged = AG_PRIORS.merge(EXTENDED_PRIORS)
+        KnowledgeBase.priors.each do |tech, (a, b)|
+          merged[tech] = if merged[tech]
+            [merged[tech][0] + a, merged[tech][1] + b]
+          else
+            [a, b]
+          end
+        end
+        merged
+      end
+    end
+
+    def verify(applicable, facts:, buffer_size:)
+      # Arithmetic feasibility only. The SMT seam (payload_fits_smtlib +
+      # SmtProcess) is available to consumers; the pipeline does not
+      # claim to run a solver.
+      applicable.each_with_object({}) do |tech, out|
+        checks = {}
+        checks[:payload_fits] = Verifier.payload_fits(buffer_size: buffer_size, payload_min: 40)
+        out[tech] = {status: (checks.values.all? { |s| s == :sat }) ? :sat : :unsat, checks: checks}
+      end
+    end
+
+    def plan_for(applicable, seed: nil, packs: nil)
+      return [] if applicable.empty?
+
+      model = packs ? Mcts.merged_model(packs) : Mcts::STAGE_MODEL
+      _first, path = Mcts.plan(applicable, iterations: 2000, seed: seed || 42, model: model)
+      path
+    end
+  end
+end

data/home/runner/work/augure/augure/lib/augure/priors.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Augure
+  # AG-derived priors (200 synthetic targets, seed 42) encoding the weight
+  # inversions the genetic algorithm found against human intuition:
+  # humans overweighted shellcode/ret2libc and underweighted ret2plt/fmtstr.
+  AG_PRIORS = {
+    "shellcode" => [5, 13],
+    "ret2libc" => [2, 18],
+    "rop" => [10, 10],
+    "fmtstr_write" => [12, 8],
+    "ret2plt" => [15, 5],
+    "ret2func" => [16, 4],
+    "srop" => [4, 6],
+    "dlresolve" => [3, 7],
+    "heap_fastbin" => [3, 7],
+    "heap_tcache" => [4, 6],
+    "heap_overwrite" => [12, 8],
+    "ret2plt_leak" => [8, 4]
+  }.freeze
+
+  # Priors for techniques the AG simulation did not cover. Authored from
+  # documented public suites (ROP Emporium, Protostar, exploit.education
+  # Phoenix write-ups) and calibrated with KB pseudo-counts - declared as
+  # authored constants, not as measured results.
+  EXTENDED_PRIORS = {
+    "fmtstr_leak" => [13, 7],   # leaks are enablers: they defeat PIE/canary
+    "ret2csu" => [14, 6],       # reliable when the csu gadgets exist
+    "stack_pivot" => [13, 7],   # required under stack-space constraints
+    "got_overwrite" => [13, 7]  # partial RELRO makes GOT redirection cheap
+  }.freeze
+end

data/home/runner/work/augure/augure/lib/augure/rules.rb

@@ -0,0 +1,300 @@
+# frozen_string_literal: true
+
+module Augure
+  # Rules-as-data: the single source of truth for technique applicability.
+  #
+  # Each rule is data: an id (the provenance handle), a head relation/value,
+  # and a list of conditions. The Engine interprets the table; a future
+  # generator emits the same table as a Souffle .dl program, so the two
+  # engines cannot diverge the way the Python prototype's did.
+  #
+  # Condition forms:
+  #   [:fact,     rel, val]            any tuple rel(val) present
+  #   [:not_fact, rel, val]            rel(val) absent (inputs only)
+  #   [:match,    rel, idx, pattern]   arg idx matches /pattern/
+  #   [:cmp,      rel, op, n]          integer arg satisfies V <op> n
+  class Rules
+    Rule = Struct.new(:id, :head, :conditions, :source, :origin)
+
+    APPLICABLE = "applicable"
+
+    # Input-relation defaults, matching the prototype's closed-world
+    # semantics: an absent fact means the default below, not absence.
+    DEFAULTS = {
+      "nx" => "true", "pie" => "true", "canary" => "false"
+    }.freeze
+
+    class << self
+      def all
+        @all ||= build.freeze
+      end
+
+      def applicable_rules
+        all.select { |r| r.head[0] == APPLICABLE }
+      end
+
+      def inputs
+        Facts::SCHEMA
+      end
+
+      private
+
+      def build
+        builder = Builder.new
+        builder.tap { |b| populate(b) }.rules
+      end
+
+      def populate(b)
+        # -- derived: vulnerability classes from hints -------------------
+        b.rule :vuln_sof_gets, %w[vuln sof],
+          source: "gets() presence implies stack overflow" do |c|
+          c.match "vuln_hint", 0, "unsafe_func:gets"
+        end
+        b.rule :vuln_sof_strcpy, %w[vuln sof],
+          source: "strcpy() presence implies stack overflow" do |c|
+          c.match "vuln_hint", 0, "unsafe_func:strcpy"
+        end
+        b.rule :vuln_fmtstr_printlike, %w[vuln fmtstr],
+          source: "printf-like unsized format functions" do |c|
+          c.match "vuln_hint", 0, "printf|sprintf"
+        end
+
+        # -- derived: gadget families ------------------------------------
+        b.rule :fam_reg_control, %w[has_reg_control true],
+          source: "any pop gadget gives register control" do |c|
+          c.match "gadget", 0, "pop"
+        end
+        b.rule :fam_write_primitive, %w[has_write_primitive true],
+          source: "any mov-store gadget gives a write primitive" do |c|
+          c.match "gadget", 0, "mov"
+        end
+        b.rule :fam_syscall_gadget, %w[has_syscall_gadget true],
+          source: "syscall or int80 gadget" do |c|
+          c.match "gadget", 0, "syscall|int80"
+        end
+        b.rule :fam_csu_gadget, %w[has_csu_gadget true],
+          source: "__libc_csu_init popper/mov gadget family" do |c|
+          c.match "gadget", 0, "csu"
+        end
+        b.rule :fam_pivot_gadget, %w[has_pivot_gadget true],
+          source: "stack pivot gadget (xchg/mov rsp)" do |c|
+          c.match "gadget", 0, "xchg"
+        end
+        b.rule :enough_from_reg, %w[enough_gadgets true],
+          source: "register control alone sustains a ROP chain" do |c|
+          c.fact "has_reg_control", "true"
+        end
+        b.rule :enough_from_write, %w[enough_gadgets true],
+          source: "a write primitive alone sustains a ROP chain" do |c|
+          c.fact "has_write_primitive", "true"
+        end
+
+        # -- applicable: stack techniques (vuln = sof) --------------------
+        b.rule :app_shellcode, ["applicable", "shellcode"],
+          source: "NX off + no canary + unfiltered return: inject and jump" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "false"
+          c.fact "canary", "false"
+          c.not_fact "return_addr_filtered", "true"
+          # the technique as-modeled ends in execve: dead under a
+          # filter - the orw pack owns the seccomp case
+          c.not_fact "seccomp", "true"
+        end
+        b.rule :app_ret2func, ["applicable", "ret2func"],
+          source: "win function present at fixed address, no PIE" do |c|
+          c.fact "vuln", "sof"
+          c.fact "pie", "false"
+          c.fact "target_function", "true"
+        end
+        b.rule :app_ret2plt, ["applicable", "ret2plt"],
+          source: "system@plt imported: call it directly, no leak" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "pie", "false"
+          c.fact "plt", "system"
+        end
+        b.rule :app_ret2libc_plt, ["applicable", "ret2libc"],
+          source: "__libc_start_main@plt exposes libc base" do |c|
+          c.fact "vuln", "sof"
+          c.fact "plt", "__libc_start_main"
+          c.not_fact "seccomp", "true"
+        end
+        b.rule :app_ret2libc_libc, ["applicable", "ret2libc"],
+          source: "libc known/version pinned: offsets computable" do |c|
+          c.fact "vuln", "sof"
+          c.fact "libc_present", "true"
+          c.not_fact "seccomp", "true"
+        end
+        b.rule :app_rop, ["applicable", "rop"],
+          source: "NX on with gadget supply: chain primitives" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "enough_gadgets", "true"
+          c.not_fact "seccomp", "true"
+        end
+        b.rule :app_srop, ["applicable", "srop"],
+          source: "sigreturn frame + syscall gadget: full register set" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "sigreturn_frame", "true"
+          c.fact "has_syscall_gadget", "true"
+          c.not_fact "seccomp", "true"
+        end
+        b.rule :app_ret2plt_leak, ["applicable", "ret2plt_leak"],
+          source: "PIE on: leak via puts@plt with register control" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "pie", "true"
+          c.fact "plt", "puts"
+          c.fact "has_reg_control", "true"
+        end
+
+        # -- applicable: format string -----------------------------------
+        b.rule :app_fmtstr_write, ["applicable", "fmtstr_write"],
+          source: "format string bug: arbitrary write, NX-independent" do |c|
+          c.fact "vuln", "fmtstr"
+        end
+        # The leak is a strategy of its own when there is a read primitive or
+        # a protection worth bypassing: %x/%s reads defeat PIE and canaries.
+        b.rule :app_fmtstr_leak_read, ["applicable", "fmtstr_leak"],
+          source: "read primitive: arbitrary stack read via format string" do |c|
+          c.fact "vuln", "fmtstr"
+          c.fact "fmtstr_read", "true"
+        end
+        b.rule :app_fmtstr_leak_pie, ["applicable", "fmtstr_leak"],
+          source: "PIE on: leak a code pointer to defeat ASLR" do |c|
+          c.fact "vuln", "fmtstr"
+          c.fact "pie", "true"
+        end
+        b.rule :app_fmtstr_leak_canary, ["applicable", "fmtstr_leak"],
+          source: "canary on: leak the stack cookie before smashing" do |c|
+          c.fact "vuln", "fmtstr"
+          c.fact "canary", "true"
+        end
+
+        # -- applicable: deferred symbol resolution ----------------------
+        b.rule :app_ret2dlresolve, ["applicable", "ret2dlresolve"],
+          source: "lazy binding + writable relocation: fake DT_SYMTAB " \
+                  "resolves an arbitrary symbol (ROP Emporium " \
+                  "ret2dlresolve, documented)" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "pie", "false"
+          c.fact "dt_lazy", "true"
+          c.fact "reloc_writable", "true"
+        end
+
+        # -- applicable: __libc_csu_init gadget universe -----------------
+        b.rule :app_ret2csu, ["applicable", "ret2csu"],
+          source: "csu gadgets populate rdx/rsi/rdi in sparse binaries " \
+                  "(ROP Emporium ret2csu, documented)" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "has_csu_gadget", "true"
+        end
+
+        # -- applicable: stack pivot under space constraints --------------
+        b.rule :app_stack_pivot, ["applicable", "stack_pivot"],
+          source: "limited stack space: pivot to a larger buffer first " \
+                  "(ROP Emporium pivot, documented)" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "limited_stack", "true"
+          c.fact "has_pivot_gadget", "true"
+        end
+
+        # -- applicable: GOT overwrite ------------------------------------
+        b.rule :app_got_overwrite_sof, ["applicable", "got_overwrite"],
+          source: "writable GOT target: overwrite an entry to redirect " \
+                  "a call via a ROP write primitive (documented)" do |c|
+          c.fact "vuln", "sof"
+          c.fact "nx", "true"
+          c.fact "got_overwrite_target", "true"
+          c.not_fact "relro", "full"
+        end
+        b.rule :app_got_overwrite_fmtstr, ["applicable", "got_overwrite"],
+          source: "writable GOT + format string: %n writes the GOT " \
+                  "entry and redirects the call (phoenix format-four, " \
+                  "documented)" do |c|
+          c.fact "vuln", "fmtstr"
+          c.fact "got_overwrite_target", "true"
+          c.not_fact "relro", "full"
+        end
+
+        # -- applicable: heap ---------------------------------------------
+        b.rule :app_heap_tcache_alloc, ["applicable", "heap_tcache"],
+          source: "tcache allocator: tcache poisoning" do |c|
+          c.fact "vuln", "heap"
+          c.fact "allocator", "tcache"
+        end
+        b.rule :app_heap_tcache_glibc, ["applicable", "heap_tcache"],
+          source: "glibc 2.26..2.33: tcache exists by default" do |c|
+          c.fact "vuln", "heap"
+          c.cmp "glibc_minor", :ge, 26
+          c.cmp "glibc_minor", :lt, 34
+        end
+        b.rule :app_heap_fastbin_glibc, ["applicable", "heap_fastbin"],
+          source: "glibc < 2.26: fastbin is the mechanism" do |c|
+          c.fact "vuln", "heap"
+          c.cmp "glibc_minor", :lt, 26
+        end
+        b.rule :app_heap_fastbin_alloc, ["applicable", "heap_fastbin"],
+          source: "ptmalloc2 fastbin context" do |c|
+          c.fact "vuln", "heap"
+          c.fact "allocator", "ptmalloc2"
+        end
+        b.rule :app_heap_overwrite_dlmalloc, ["applicable", "heap_overwrite"],
+          source: "dlmalloc: adjacency overwrite" do |c|
+          c.fact "vuln", "heap"
+          c.fact "allocator", "dlmalloc"
+        end
+        b.rule :app_heap_overwrite_fp, ["applicable", "heap_overwrite"],
+          source: "function pointer on heap: overwrite it" do |c|
+          c.fact "vuln", "heap"
+          c.fact "function_pointer_on_heap", "true"
+        end
+      end
+    end
+
+    # Tiny DSL used to declare rules as data.
+    class Builder
+      attr_reader :rules
+
+      def initialize
+        @rules = []
+      end
+
+      def rule(id, head, source:, &block)
+        collector = ConditionCollector.new
+        block.call(collector)
+        @rules << Rule.new(
+          id: id, head: head, conditions: collector.conditions, source: source
+        )
+      end
+
+      class ConditionCollector
+        attr_reader :conditions
+
+        def initialize
+          @conditions = []
+        end
+
+        def fact(rel, val)
+          @conditions << [:fact, rel, val]
+        end
+
+        def not_fact(rel, val)
+          @conditions << [:not_fact, rel, val]
+        end
+
+        def match(rel, idx, pattern)
+          @conditions << [:match, rel, idx, pattern]
+        end
+
+        def cmp(rel, op, n)
+          @conditions << [:cmp, rel, op, n]
+        end
+      end
+    end
+  end
+end

data/home/runner/work/augure/augure/lib/augure/smt_process.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "open3"
+require "timeout"
+
+module Augure
+  # Thin subprocess boundary to any SMT-LIB solver (z3, bitwuzla, cvc5).
+  # Contract: SMT-LIB text in, status atom out. Unknown/timeout = :unknown,
+  # never an exception: a verification failure must be visible, not fatal.
+  module SmtProcess
+    module_function
+
+    def solve(smt_text, solver:, timeout: 10)
+      out = nil
+      ok = false
+      Open3.popen3(solver) do |stdin, stdout, _stderr, waiter|
+        stdin.write(smt_text)
+        stdin.close
+        begin
+          Timeout.timeout(timeout) do
+            out = stdout.read
+            ok = waiter.value.success?
+          end
+        rescue Timeout::Error
+          kill_quietly(waiter)
+          return :unknown
+        end
+      end
+      parse_status(out) if ok
+    rescue
+      :unknown
+    end
+
+    def parse_status(stdout)
+      case stdout
+      when /\bsat\b/ then :sat
+      when /\bunsat\b/ then :unsat
+      else :unknown
+      end
+    end
+
+    def kill_quietly(waiter)
+      Process.kill("KILL", waiter.pid)
+    rescue
+      nil
+    end
+  end
+end

data/home/runner/work/augure/augure/lib/augure/verifier.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "open3"
+require "timeout"
+
+module Augure
+  # Numerical feasibility checks. The fast path is constant arithmetic in
+  # plain Ruby; the same checks emit SMT-LIB v2 text for a real solver via
+  # SmtProcess. The formal story survives because both paths run on the same
+  # corpus and must agree.
+  module Verifier
+    module_function
+
+    def payload_fits(buffer_size:, payload_min:)
+      (buffer_size >= payload_min) ? :sat : :unsat
+    end
+
+    def bad_bytes?(payload:, bad_bytes:)
+      payload.any? { |byte| bad_bytes.include?(byte) }
+    end
+
+    def rop_chain_feasible?(required_gadgets:, present_gadgets:, payload:, bad_bytes:, stack_size:)
+      return false unless (required_gadgets - present_gadgets).empty?
+      return false if bad_bytes?(payload: payload, bad_bytes: bad_bytes)
+      return false if payload.size > stack_size
+
+      true
+    end
+
+    def payload_fits_smtlib(buffer_size, payload_min)
+      <<~SMT
+        (set-logic QF_LIA)
+        (declare-const buffer_size Int)
+        (assert (= buffer_size #{buffer_size.to_i}))
+        (assert (>= buffer_size #{payload_min.to_i}))
+        (check-sat)
+      SMT
+    end
+  end
+end

data/home/runner/work/augure/augure/lib/augure/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Augure
+  VERSION = "0.1.0"
+end

data/home/runner/work/augure/augure/lib/augure.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "augure/version"
+
+module Augure
+  class Error < StandardError; end
+  class MalformedFact < Error; end
+  class UnknownPredicate < Error; end
+  class EngineError < Error; end
+  class PackError < Error; end
+end
+
+require_relative "augure/facts"
+require_relative "augure/rules"
+require_relative "augure/engine"
+require_relative "augure/bandit"
+require_relative "augure/mcts"
+require_relative "augure/pack"
+require_relative "augure/pack_loader"
+require_relative "augure/knowledge_base"
+require_relative "augure/verifier"
+require_relative "augure/smt_process"
+require_relative "augure/priors"
+require_relative "augure/coverage"
+require_relative "augure/pipeline"

data/home/runner/work/augure/augure/packs/banner_leak.yml

@@ -0,0 +1,46 @@
+technique: banner_leak
+author: Gregory Epp
+source: lictor lab - the banner practice is everywhere in CTF services
+
+rules:
+  - id: app_banner_leak
+    head: [applicable, banner_leak]
+    conditions:
+      - [fact, service, unknown]
+      - [fact, verified, remote]
+      - [fact, software_version, 0]
+
+kb:
+  - id: banner_leak_001
+    technique: banner_leak
+    description: >
+      The service prints its own addresses: "win() at 0x4011d6" is an
+      address handed over before the first input. The verified remote
+      fact anchors the observation; the leak feeds the build slots.
+    chain: [banner_read, address_parse, payload_assemble]
+    unlocks: [addresses]
+    success_rate: 0.60
+
+mcts:
+  requires: []
+  provides: [addresses]
+  terminal: false
+  success: 0.60
+
+priors: [7, 13]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: wire
+    signature: "the service's banner carries raw hex addresses (%p prints)"
+    note: "the leak itself: addresses handed over before the first input"
+  - channel: syslog
+    signature: "short-lived connections that read only the greeting"
+    note: "a leak pass: connect-read-close, no input sent"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1592
+  - T1595

data/home/runner/work/augure/augure/packs/brop.yml

@@ -0,0 +1,46 @@
+technique: brop
+author: Gregory Epp
+source: https://ctf-wiki.org/pwn/linux/user-mode/stackoverflow/x86/advanced-rop/brop/
+
+rules:
+  - id: app_brop
+    head: [applicable, brop]
+    conditions:
+      - [fact, remote, true]
+      - [fact, verified, remote]
+      - [fact, nx, true]
+
+kb:
+  - id: brop_001
+    technique: brop
+    description: >
+      Blind ROP: no binary, only a remote oracle that faults. The crash
+      differential (the verified fact) anchors the model; stop-gadget
+      hunting and a BROP gadget leak enough libc to call system.
+      First rule that consumes a verified observation, not a modeled one.
+    chain: [stop_gadget, brop_gadget, dump_libc, system_call]
+    unlocks: [libc_base]
+    success_rate: 0.30
+
+mcts:
+  requires: []
+  provides: [libc_base]
+  terminal: false
+  success: 0.30
+
+priors: [6, 14]
+
+
+# The defender side (the corpus read backwards): what this technique
+# looks like to the defenses. Armored by check 9.
+detection:
+  - channel: wire
+    signature: "highly regular connect-probe cycles with alternating payloads"
+    note: "the differential probing pattern (fault oracle discovery)"
+  - channel: crash
+    signature: "child SIGSEGV on long inputs, the service keeps accepting"
+    note: "the crash oracle being exercised"
+
+# The ATT&CK mapping (the navigator export consumes it)
+mitre:
+  - T1068