@osqd/bothandlerjs 0.5.0 → 0.7.0

package/dist/state.d.ts

@@ -12,6 +12,7 @@ import type { ActorSnapshot, RequestFacts } from "./types.js";
  */
 export declare const MAX_TRACKED_ARRIVALS = 32;
 export declare const MAX_TRACKED_PATHS = 64;
+export declare const MAX_TRACKED_QUERIES = 64;
 export declare const MAX_TRACKED_USER_AGENTS = 4;
 export declare class ActorState {
     readonly key: string;
@@ -53,6 +54,96 @@ export declare class ActorState {
     private readonly paths;
     private pathsOverflowed;
     private pathsSaturatedAtTotal;
+    /**
+     * Distinct *parameterised* requests: the path together with its query.
+     *
+     * Counted apart from `paths` because the two answer different questions and a scraper
+     * lives in the gap between them. `/products?page=1` through `?page=200` is one path and
+     * two hundred requests, so breadth reads it as somebody rereading a single page — which
+     * is exactly what enumerating a catalogue looks like from the path alone.
+     */
+    private readonly queries;
+    private queriesOverflowed;
+    /**
+     * Which HTTP methods this actor has used.
+     *
+     * A browser navigating issues GET. Something that has issued nothing but HEAD across a
+     * long visit is checking what exists rather than reading it, and that is a fact about
+     * the actor rather than about any one of its requests — which is why it is kept here.
+     */
+    /**
+     * What has happened with this actor's marker cookie.
+     *
+     * Counted rather than listed: the useful questions are all "how often", and a list of
+     * marker ids would grow with a client's cookie jar for no benefit. The three drift
+     * flags are sticky — once a client has been seen claiming two different browsers under
+     * one marker it has done so, and a later request that looks tidy again does not undo
+     * it. That is the point of correlating a series rather than judging a request.
+     */
+    /**
+     * When this actor was last challenged, and how it described itself at that moment.
+     *
+     * Kept so that what a client does *in response* to being challenged can be read. That
+     * reaction is better evidence than anything observed passively, because the stimulus
+     * was ours: we chose the moment, so a change of identity that follows it within
+     * seconds is a reaction to it rather than a coincidence we went looking for.
+     */
+    /**
+     * Answers to challenges that were valid in form but wrong in a way only the series
+     * shows: a solution already spent, or one returned faster than the puzzle allows.
+     */
+    /** Requests for a path no other client had ever asked this site for. */
+    private novelPaths;
+    private replayedSolutions;
+    private implausibleSolves;
+    private challengedAt;
+    private challengeShape;
+    private markerIssues;
+    private markerReturns;
+    private markerForgeries;
+    private driftSeen;
+    private driftEvents;
+    private readonly methods;
+    /**
+     * Numeric walks in progress, by path shape: `/user/#` against the ids requested under it.
+     *
+     * Three numbers per shape, deliberately — a count, a lowest and a highest — rather than
+     * the ids themselves. What separates enumeration from reading is not which ids were
+     * asked for but whether they *cover a range*: thirty requests spanning thirty
+     * consecutive ids is a walk, and thirty scattered across a hundred thousand is somebody
+     * following links. Both are answerable from a count and a span, and only the count and
+     * the span survive an actor asking for ten thousand of them.
+     */
+    private readonly walks;
+    /**
+     * Every named identity this actor has claimed, and what kind each was.
+     *
+     * Kept because the interesting question is not what one request said but what the *set*
+     * of them says. One address claiming sqlmap and nikto is a scan; one claiming Googlebot
+     * and Bingbot is a forgery, since at most one of those can be true of an address. Neither
+     * observation exists inside a single request.
+     */
+    private readonly identities;
+    /**
+     * A name somebody gave this actor.
+     *
+     * Nothing in detection reads it. It exists because an address is not a memory: the
+     * person who worked out that `198.51.100.4` is the partner's price feed should be able
+     * to write that down where the next person will see it, rather than in a ticket.
+     */
+    private actorLabel;
+    /** Requests from this actor that carried a scanner payload or target. */
+    private probePayloads;
+    /**
+     * What the application answered, for the requests anybody bothered to tell us about.
+     *
+     * The engine decides *before* the response exists, so this arrives afterwards and only
+     * when the adapter reports it. Kept as two counters rather than a list because the one
+     * question worth asking is a ratio: an actor whose requests are almost all misses is
+     * looking for something rather than reading anything.
+     */
+    private responsesSeen;
+    private missesSeen;
     private readonly userAgents;
     constructor(key: string, now: number);
     /** Records an arrival. Called exactly once per request, by the engine. */
@@ -60,6 +151,102 @@ export declare class ActorState {
     /** Distinct paths seen, by hash. Saturates at {@link PATH_CAP}; `pathsSaturated` says whether it did. */
     get distinctPaths(): number;
     get pathsSaturated(): boolean;
+    /** Distinct path-and-query combinations seen. Saturates at {@link QUERY_CAP}. */
+    get distinctQueries(): number;
+    get queriesSaturated(): boolean;
+    /**
+     * Records what the application answered. Called after the response, if at all.
+     *
+     * 404 and 410 only. A 403 is usually this library's own doing and counting it would
+     * make the detector that reads this argue with itself; a 500 is the site's problem and
+     * says nothing about the client.
+     */
+    recordOutcome(status: number): void;
+    /** Responses reported for this actor. Zero unless something is reporting them. */
+    get responses(): number;
+    /** Of those, how many were 404 or 410. */
+    get misses(): number;
+    /** Names this actor, or clears the name when given nothing. Trimmed and bounded. */
+    setLabel(label: string | undefined): void;
+    get label(): string | undefined;
+    /** Records a named identity this actor claimed. Called once per matching signature. */
+    noteIdentity(id: string, category: string, verifiable: boolean): void;
+    /** Records that this request was for a path the site had never served to anybody. */
+    noteNovelPath(): void;
+    /** How many of this actor's requests were for a path nobody else had ever asked for. */
+    get novelPathCount(): number;
+    /** Records something wrong with a submitted solution that only its history reveals. */
+    noteChallengeAnomaly(kind: "replay" | "implausible-speed"): void;
+    /** Solutions this actor submitted that had already been spent, and ones returned too fast. */
+    get challengeAnomalies(): {
+        replays: number;
+        implausible: number;
+    };
+    /** Records that a challenge went out, and the identity claimed as it did. */
+    noteChallengeIssued(at: number, shape: {
+        b: string;
+        o: string;
+        l: string;
+    } | undefined): void;
+    /** The moment of the last challenge, and the identity claimed then. `at` is 0 for none. */
+    get lastChallenge(): {
+        at: number;
+        shape: {
+            b: string;
+            o: string;
+            l: string;
+        } | undefined;
+    };
+    /** Records that a marker was handed to this actor on the way out. */
+    noteMarkerIssued(): void;
+    /** Records what this request's marker cookie turned out to be. */
+    noteMarker(returned: boolean, forged: boolean, drift: {
+        browser: boolean;
+        platform: boolean;
+        language: boolean;
+    } | undefined): void;
+    /** Markers handed to this actor, and how many came back. */
+    get markers(): {
+        issued: number;
+        returned: number;
+        forged: number;
+    };
+    /** Which parts of a claimed identity have ever changed under one marker. */
+    get identityDrift(): {
+        browser: boolean;
+        platform: boolean;
+        language: boolean;
+        events: number;
+    };
+    /** Records that this request carried a scanner payload, so later requests can know. */
+    notePayloadProbe(): void;
+    /** Every identity claimed so far, by id. */
+    get claimedIdentities(): ReadonlyMap<string, {
+        category: string;
+        verifiable: boolean;
+    }>;
+    /** How many of this actor's requests carried a scanner payload or target. */
+    get payloadProbes(): number;
+    /**
+     * Files a request under the shape of its path, if that path carries a number.
+     *
+     * The last numeric segment is the one taken to be the identifier: in `/api/v2/orders/42`
+     * the version is part of the shape and the order id is what is being walked.
+     */
+    private noteWalk;
+    /**
+     * The path shape this actor has walked hardest, with how far it reached.
+     *
+     * `span` is inclusive of both ends, so a walk of 1 to 30 spans 30. Comparing the count
+     * against it is what separates covering a range from visiting a few points in one.
+     */
+    densestWalk(): {
+        template: string;
+        count: number;
+        span: number;
+    } | undefined;
+    /** Every HTTP method this actor has used, in first-seen order. */
+    get methodsSeen(): readonly string[];
     /**
      * Requests seen when {@link distinctPaths} stopped being able to grow, or 0 if it
      * still can. Over that many requests the distinct count is exact, so it is the only
@@ -159,3 +346,21 @@ export declare class ActorRegistry {
     /** Marks an actor as holding valid human clearance until `until`. */
     clearUntil(key: string, until: number): void;
 }
+/**
+ * One step of a numeric walk: the shape of the path, and the number in it.
+ *
+ * `/api/v2/orders/42` becomes `/api/v2/orders/#` and `42`. Shared between the per-actor
+ * series and the site-wide one, which must agree on what a shape is or their counts
+ * cannot be compared.
+ *
+ * Both bounds are checked without allocating, because both exist to stop a client paying
+ * us to do work. `split` allocates a string per segment, so counting separators first is
+ * what makes the depth check worth having. Measured on a sixty-segment path: 3.65µs
+ * against 199ns for an ordinary one — every request eighteen times dearer, for free,
+ * from anyone willing to send a long URL. The concatenation was most of it; the split
+ * was the rest.
+ */
+export declare function walkStepOf(path: string): {
+    template: string;
+    id: number;
+} | undefined;

package/dist/stores/redis.d.ts

@@ -9,7 +9,6 @@ import type { Clock } from "../internal/clock.js";
  */
 export interface RedisLike {
     incr(key: string): Promise<number>;
-    pexpire(key: string, ms: number): Promise<unknown>;
     /**
      * `SET key value PX ttl [NX]`.
      *
@@ -51,6 +50,30 @@ export declare class RedisStore implements BotHandlerStore {
     private readonly prefix;
     private readonly clock;
     constructor(client: RedisLike, options?: RedisStoreOptions);
+    /**
+     * Counts one request into the fixed window `key` is bucketed by.
+     *
+     * This used to be `INCR`, then `PEXPIRE` when the count came back as 1 — which is
+     * correct only if the process survives long enough to send the second command. A
+     * deploy, an OOM kill or a dropped connection in between left a counter key behind
+     * with no expiry at all, and nothing would ever clean it up: the next request falls
+     * into the next bucket, under a different key, so the orphan is never touched again.
+     * One per unlucky restart is nothing; the point is that it accumulates forever, in a
+     * Redis the operator may well be running with `noeviction`.
+     *
+     * So the expiry is armed by the command that *creates* the key rather than by a
+     * follow-up. `SET … PX … NX` writes the seed only if nothing is there, always with a
+     * lifetime, and does nothing at all once the bucket exists — so it neither costs a
+     * count nor re-arms a window under load. The `INCR` is issued without waiting for its
+     * reply, so both commands are on the wire together and this stays one round trip.
+     * Ordering holds because a Redis client writes commands to its connection in call
+     * order and Redis executes them in arrival order, which means the key has a lifetime
+     * from the instant it exists.
+     *
+     * Not a Lua script, which would make it a single command: `eval` is the one thing
+     * `ioredis` and `node-redis` spell differently enough that this interface could not
+     * describe both, and staying client-agnostic is worth more than the last round trip.
+     */
     increment(key: string, windowMs: number): Promise<number>;
     consumeOnce(key: string, ttlMs: number): Promise<boolean>;
     get(key: string): Promise<string | undefined>;

package/dist/types.d.ts

@@ -7,6 +7,7 @@
  * detection is a solved problem: probabilistic signals exist, they are useful, and
  * they are structurally barred from reaching a terminal action.
  */
+import type { MarkerObservation } from "./probe/index.js";
 /** What kind of client we believe we are talking to. */
 export type BotClass = 
 /** Positive evidence of a person driving a real browser. */
@@ -92,6 +93,15 @@ export interface Evidence {
     deterministicBasis?: string | undefined;
     /** Structured detail for logs and dashboards. Must be JSON-serialisable. */
     metadata?: Record<string, unknown> | undefined;
+    /**
+     * Set when this came from a detector named in {@link BotHandlerConfig.shadowDetectors}.
+     *
+     * It is a label rather than a mechanism: shadowed evidence never reaches scoring at
+     * all, because it is kept in {@link Assessment.shadowEvidence} rather than filtered out
+     * of {@link Assessment.evidence} later. The flag is here so that anything rendering the
+     * two lists together can say which is which.
+     */
+    shadow?: true | undefined;
 }
 /**
  * Every verdict and class, in a fixed order.
@@ -128,6 +138,21 @@ export interface RequestFacts {
     method: string;
     /** Path only, no query string. Always begins with `/`. */
     path: string;
+    /**
+     * The target as the client actually spelled it, present only when that is not how
+     * `path` reads.
+     *
+     * `path` is normalised — decoded once, backslashes and doubled slashes collapsed, dot
+     * segments resolved — because a rule scoped to `/admin` has to hold against `/%61dmin`
+     * and `/./admin` too. That normalisation is also the only thing that makes an evasive
+     * target look ordinary: `/%2e%2e%2f%2e%2e%2fapp/config.yml` becomes `/app/config.yml`.
+     * This is where the difference is kept, so `target-integrity` can read it.
+     *
+     * Absent on the overwhelming majority of requests, which is the whole reason it is
+     * cheap: its presence already means the target was spelled unusually, though not
+     * necessarily suspiciously — a trailing slash is enough.
+     */
+    rawPath?: string | undefined;
     /** Decoded query parameters. Null-prototype so `?__proto__=x` is visible, not swallowed. */
     query: Record<string, string>;
     /** Lowercased header names to values. Multi-value headers are joined with `, `. */
@@ -178,6 +203,49 @@ export interface ActorSnapshot {
     requests: number;
     /** Distinct paths seen inside the window — breadth of crawl. */
     distinctPaths: number;
+    /**
+     * Distinct path-and-query combinations seen from this actor.
+     *
+     * Separate from `distinctPaths` because a scraper lives in the gap between them:
+     * `/products?page=1` through `?page=200` is one path and two hundred requests.
+     */
+    distinctQueries: number;
+    /** Whether `distinctQueries` stopped being able to grow. */
+    queriesSaturated: boolean;
+    /**
+     * Every HTTP method this actor has used.
+     *
+     * A browser navigating issues GET; an actor whose whole visit is HEAD is checking what
+     * exists rather than reading it.
+     */
+    methodsSeen: readonly string[];
+    /**
+     * Responses reported back for this actor, and how many of them were misses.
+     *
+     * Both zero unless something calls `recordOutcome` — the engine decides before a
+     * response exists, so this is knowledge only the application has.
+     */
+    responses: number;
+    /** Of `responses`, how many were 404 or 410. */
+    misses: number;
+    /**
+     * The path shape this actor has walked hardest — `/user/#` — with how many requests
+     * went to it and how wide a range of numbers they covered.
+     *
+     * Undefined when no path carried a number. `span` is inclusive, so ids 1 to 30 span 30.
+     */
+    walk?: {
+        template: string;
+        count: number;
+        span: number;
+    } | undefined;
+    /**
+     * A name somebody gave this actor. Never read by detection.
+     *
+     * An address is not a memory: whoever worked out that one belongs to a partner's price
+     * feed should be able to write it where the next person will see it.
+     */
+    label?: string | undefined;
     /** First and last sighting, ms since epoch. */
     firstSeen: number;
     lastSeen: number;
@@ -219,6 +287,36 @@ export interface Assessment {
     evidence: Evidence[];
     /** Every human-pointing observation. These rebut and dampen the score. */
     humanEvidence: Evidence[];
+    /**
+     * What the shadowed detectors said, in both directions, and what none of it did.
+     *
+     * A detector listed in {@link BotHandlerConfig.shadowDetectors} runs exactly as it
+     * otherwise would and its findings land here instead of in `evidence` — so they are
+     * counted, charted and readable, and they took no part in the verdict, the score, the
+     * class, the identity, or any rule. Not "weighted at zero": kept out of the arithmetic
+     * altogether, because a `certain` finding does not go through the arithmetic and a
+     * weight of zero would not have stopped it.
+     *
+     * This is how a new detector, or a threshold nobody is sure of yet, is answered with a
+     * week of your own traffic rather than with an argument.
+     */
+    shadowEvidence: Evidence[];
+    /**
+     * What this assessment would have been had the shadowed detectors been counted.
+     *
+     * Present only when a shadowed detector actually found something, which is what keeps
+     * the second pass off the hot path for the requests it would say nothing about.
+     *
+     * "It fired 312 times" is not the question anybody has. The question is what turning it
+     * on would *do*, and the only honest form of that is the verdict this request would
+     * have received — including, and especially, when it is a person.
+     */
+    shadowVerdict?: {
+        verdict: Verdict;
+        botClass: BotClass;
+        score: number;
+        certain: boolean;
+    } | undefined;
     actor: ActorSnapshot;
     /**
      * Set when detection was skipped rather than performed. `undefined` means every
@@ -232,6 +330,14 @@ export interface Assessment {
     /** Detectors that threw or timed out. Detection continues without them. */
     failures: DetectorFailure[];
     facts: RequestFacts;
+    /**
+     * What the marker cookie on this request turned out to be, when the probe is on.
+     *
+     * An input rather than a conclusion, kept here for the same reason `facts` is: the
+     * action path needs it to decide whether this response should carry a new marker, and
+     * recomputing it would mean verifying the same HMAC twice on every request.
+     */
+    marker?: MarkerObservation | undefined;
 }
 /** Why an assessment skipped detection. */
 export type BypassReason = 

package/docs/course/05-detectors.md

@@ -1,6 +1,6 @@
 # Lesson 5 — The detectors
 
-**Goal:** know what each of the twenty detectors reads, what it costs, and what it is
+**Goal:** know what each of the detectors reads, what it costs, and what it is
 allowed to conclude — then turn one off and watch the score move.
 
 ← [Course](index.md) · Prev: [The guard](04-the-guard.md) · Next: [Identity and verification](06-identity.md)
@@ -36,7 +36,7 @@ browsing-coherence     cheap  always
 crawler-verification   io     confirming
 ```
 
-**Sixteen of twenty ship on by default.** The other four —
+**Twenty-two ship on by default.** The others —
 `identity-rotation`, `tls-fingerprint`, `clearance`, `client-signals` — each need something
 from you, and you will switch three of them on later in the course.
 
@@ -61,7 +61,7 @@ fails closed is an outage with extra steps.
 
 | Detector | Ceiling | Reads |
 | -------- | ------- | ----- |
-| `self-identified` | `certain` | 161 signatures, 389 tokens, in one Aho–Corasick pass. Also catches unrecognised crawlers that name a contact URL, and bare client tokens with no browser preamble |
+| `self-identified` | `certain` | 205 signatures, 389 tokens, in one Aho–Corasick pass. Also catches unrecognised crawlers that name a contact URL, and bare client tokens with no browser preamble |
 | `crawler-verification` | `certain` | Forward-confirmed reverse DNS, or published address ranges. **Confirms and refutes** |
 
 ### Single-request consistency
@@ -82,7 +82,12 @@ fails closed is an outage with extra steps.
 | `rate-anomaly` | `moderate` | Arrivals in a short window. Reports; never concludes |
 | `cadence` | `moderate` | Coefficient of variation of the gaps. Catches the polite scraper pacing itself *under* your rate limit |
 | `crawl-breadth` | `weak` | Distinct paths against total requests: reading a site against enumerating it |
+| `parameter-sweep` | `weak` | Distinct query strings against the paths they sit on. Catches the collection that leaves the path unchanged — `?page=1..200` |
 | `session-integrity` | `moderate` | A "browser" that never carries a cookie |
+| `blended-identity` | `strong` | The *set* of identities one actor claimed: two scanners, or two crawlers that cannot both be true |
+| `id-enumeration` | `moderate` | A contiguous run of numeric ids under one path shape — walking `/user/1..n` rather than following links |
+| `probe-volume` | `moderate` | The share of an actor's requests answered 404. Needs `recordOutcome`; every bundled adapter wires it up |
+| `transport-coherence` | `moderate` | The HTTP version and the verbs across a visit: a "Chrome" on HTTP/1.0, a visit made only of HEAD |
 | `identity-rotation` | `moderate` | One actor, several User-Agents. **Off by default** — under an IP actor key this fires on every corporate NAT |
 | `browsing-coherence` | `moderate` | The only detector arguing *for* the client. Human-pointing, so it discounts |
 
@@ -163,7 +168,7 @@ IP-based actor key.
 
 ## What you learned
 
-- Sixteen of twenty detectors are on by default; the rest need something from you
+- Twenty-one detectors are on by default; the rest need something from you — a marker probe, a challenge, a site baseline, or data only you have
 - `cost` and `stage` decide when a detector runs, and confirming work is skipped when
   nothing claimed an identity
 - A failing detector is dropped, never the request

package/docs/course/06-identity.md

@@ -9,7 +9,7 @@ a name alone is worth so little.
 
 ## A name is a claim, not a fact
 
-`self-identified` matches 161 signatures across search, AI, SEO, social, monitoring,
+`self-identified` matches 205 signatures across search, AI, SEO, social, monitoring,
 feeds, archives, security tooling, HTTP libraries and headless runtimes. When it fires you
 get an `identity` — `"googlebot"`, `"gptbot"` — and a `category`.
 

package/docs/course/16-proving-it.md

@@ -13,29 +13,35 @@ everything into a Serif you can defend.
 
 Three tools answer it, and they answer different halves.
 
-## `check` — against 526 shapes of real traffic
+## `check` — against 548 shapes of real traffic
 
 ```bash
 npx @osqd/bothandlerjs check --preset protect-content
 ```
 
 ```
-  protect-content against 522 shapes of real traffic
+  protect-content against 539 shapes of real traffic
 
-  human            181 cases   3 tag, 175 allow, 3 challenge
-  benign-bot       144 cases   6 allow, 86 tag, 48 block, 2 challenge, 2 rate-limit
-  declared-bot      32 cases   18 tag, 2 rate-limit, 3 allow, 9 block
-  unwanted-bot     105 cases   8 tag, 11 rate-limit, 3 block, 70 challenge, 13 allow
-  hostile           27 cases   6 challenge, 17 block, 4 allow
-  infrastructure    33 cases   7 allow, 12 tag, 14 challenge
+  human            184 cases   178 allow, 3 tag, 3 challenge
+  benign-bot       144 cases   86 tag, 48 block, 6 allow, 2 challenge, 2 rate-limit
+  declared-bot      32 cases   18 tag, 9 block, 3 allow, 2 rate-limit
+  unwanted-bot     109 cases   71 challenge, 16 allow, 11 rate-limit, 8 tag, 3 block
+  hostile           37 cases   20 block, 9 allow, 7 challenge, 1 tag
+  infrastructure    33 cases   14 challenge, 12 tag, 7 allow
 
   No case marked as a person was denied service.
 ```
 
+The corpus holds 548 cases and this run reports 539, which is not a discrepancy: a case
+naming a capability the configuration under test does not provide is *skipped* rather than
+failed. The nine here need a marker probe or a site baseline, and judging a marker case
+against a configuration that issues no markers would be a verdict about nothing. Turn those
+sources on and the same command reports all 548.
+
 **It exits non-zero if any case marked `human` is denied**, which is what makes it a CI step
 rather than a report.
 
-The corpus is 526 cases with provenance: 182 of them people — 30 browser profiles, 40 in-app
+The corpus is 548 cases with provenance: 186 of them people — 30 browser profiles, 40 in-app
 WebViews, Tor, screen readers, IE11, a car's infotainment screen, corporate proxies, CGNAT,
 an author signing in at `/wp-login.php`. Header order is reproduced rather than invented, and
 DNS is controlled rather than mocked away, so *"the operator's DNS disproves this"* and

package/docs/course/index.md

@@ -58,7 +58,7 @@ lesson 11.
 
 | | | |
 |-|-|-|
-| 5 | [The detectors](05-detectors.md) | All twenty: what each reads, what each costs, what each may conclude. |
+| 5 | [The detectors](05-detectors.md) | All twenty-two: what each reads, what each costs, what each may conclude. |
 | 6 | [Identity and verification](06-identity.md) | Recognising a crawler by name — and proving or refuting the claim. |
 | 7 | [Actors and behaviour](07-actors.md) | Who "the same client" is, and what watching one over time tells you. |
 | 8 | [Traps](08-traps.md) | The one detector that needs no statistics, and how to lay one properly. |

package/docs/design/decisions.md

@@ -187,7 +187,7 @@ type checker catches something.
 
 ## The corpus is a published entry point, not a test fixture
 
-**The decision.** `@osqd/bothandlerjs/corpus` ships `runCorpus` and all 526 cases.
+**The decision.** `@osqd/bothandlerjs/corpus` ships `runCorpus` and all 548 cases.
 
 **Why.** The claims in this documentation are only worth anything if you can check them
 against *your* configuration. A corpus locked inside the test suite proves things about the