@safebrowse/daemon 0.1.2-rc.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/LICENSE +15 -15
  2. package/README.md +31 -31
  3. package/dist/cli.js +9 -9
  4. package/dist/index.d.ts +1 -0
  5. package/dist/index.d.ts.map +1 -1
  6. package/dist/index.js +2 -0
  7. package/dist/index.js.map +1 -1
  8. package/dist/parserIsolation.d.ts +12 -0
  9. package/dist/parserIsolation.d.ts.map +1 -0
  10. package/dist/parserIsolation.js +57 -0
  11. package/dist/parserIsolation.js.map +1 -0
  12. package/dist/parserWorker.d.ts +2 -0
  13. package/dist/parserWorker.d.ts.map +1 -0
  14. package/dist/parserWorker.js +89 -0
  15. package/dist/parserWorker.js.map +1 -0
  16. package/dist/runtime/config/auditor/v4_prompt_injection_coverage_suite.json +2789 -0
  17. package/dist/runtime/knowledge_base/safebrowse_vf_action_integrity_patterns.json +1411 -1411
  18. package/dist/runtime/knowledge_base/safebrowse_vf_artifact_surface_patterns.json +891 -891
  19. package/dist/runtime/knowledge_base/safebrowse_vf_evaluation_scenarios.json +217 -217
  20. package/dist/runtime/knowledge_base/safebrowse_vf_incident_response_playbooks.json +209 -209
  21. package/dist/runtime/knowledge_base/safebrowse_vf_knowledge_base_index.json +143 -143
  22. package/dist/runtime/knowledge_base/safebrowse_vf_knowledge_base_index.json.sig +1 -1
  23. package/dist/runtime/knowledge_base/safebrowse_vf_knowledge_bases.zip.sig +1 -1
  24. package/dist/runtime/knowledge_base/safebrowse_vf_memory_context_poisoning_patterns.json +803 -803
  25. package/dist/runtime/knowledge_base/safebrowse_vf_policy_controls_catalog.json +686 -686
  26. package/dist/runtime/knowledge_base/safebrowse_vf_prompt_injection_patterns.json +9930 -9930
  27. package/dist/runtime/knowledge_base/safebrowse_vf_source_registry.json +345 -345
  28. package/dist/runtime/knowledge_base/safebrowse_vf_tool_protocol_supply_chain_patterns.json +879 -879
  29. package/dist/runtime/knowledge_base/safebrowse_vf_trust_signals_provenance.json +480 -480
  30. package/dist/runtime/knowledge_base/signing/safebrowse_vf_ed25519_public.pem +3 -3
  31. package/dist/runtime/policies/base/research.yaml +43 -43
  32. package/dist/runtime/policies/emergency/default.yaml +14 -14
  33. package/dist/runtime/policies/project/default.yaml +13 -13
  34. package/dist/runtime/policies/tenant/default.yaml +12 -12
  35. package/dist/server.d.ts +1 -0
  36. package/dist/server.d.ts.map +1 -1
  37. package/dist/server.js +489 -22
  38. package/dist/server.js.map +1 -1
  39. package/package.json +53 -53
package/dist/runtime/knowledge_base/safebrowse_vf_trust_signals_provenance.json CHANGED
@@ -1,480 +1,480 @@
1
- {
2
- "kb_meta": {
3
- "name": "SafeBrowse vf trust signals and provenance catalog",
4
- "version": "vf-final",
5
- "generated_on": "2026-03-28",
6
- "entry_count": 28,
7
- "purpose": "Canonical trust/provenance fields shared across all modules."
8
- },
9
- "signals": [
10
- {
11
- "signal_id": "TS-01",
12
- "name": "source_origin",
13
- "category": "origin",
14
- "description": "Canonical origin or site that supplied the observation or action target.",
15
- "used_by_modules": [
16
- "ActionIntegrityFirewall",
17
- "ObservationSanitizer"
18
- ],
19
- "source_ids": [
20
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
21
- "SRC_OPENAI_PROMPT_INJECTION_2026",
22
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
23
- ],
24
- "credibility": "high",
25
- "last_verified": "2026-03-28"
26
- },
27
- {
28
- "signal_id": "TS-02",
29
- "name": "frame_origin",
30
- "category": "origin",
31
- "description": "Origin of the specific frame, iframe, or embed where content appeared.",
32
- "used_by_modules": [
33
- "ActionIntegrityFirewall",
34
- "ArtifactSurfaceGuard"
35
- ],
36
- "source_ids": [
37
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
38
- "SRC_OPENAI_PROMPT_INJECTION_2026",
39
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
40
- ],
41
- "credibility": "high",
42
- "last_verified": "2026-03-28"
43
- },
44
- {
45
- "signal_id": "TS-03",
46
- "name": "same_origin_relation",
47
- "category": "origin",
48
- "description": "Whether content/action stays same-origin, same-site, cross-site, or cross-channel.",
49
- "used_by_modules": [
50
- "ActionIntegrityFirewall"
51
- ],
52
- "source_ids": [
53
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
54
- "SRC_OPENAI_PROMPT_INJECTION_2026",
55
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
56
- ],
57
- "credibility": "high",
58
- "last_verified": "2026-03-28"
59
- },
60
- {
61
- "signal_id": "TS-04",
62
- "name": "user_shared_flag",
63
- "category": "trust",
64
- "description": "Whether the user explicitly shared or selected this source in the current session.",
65
- "used_by_modules": [
66
- "ObservationSanitizer",
67
- "PolicyEngine"
68
- ],
69
- "source_ids": [
70
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
71
- "SRC_OPENAI_PROMPT_INJECTION_2026",
72
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
73
- ],
74
- "credibility": "high",
75
- "last_verified": "2026-03-28"
76
- },
77
- {
78
- "signal_id": "TS-05",
79
- "name": "session_discovered_flag",
80
- "category": "trust",
81
- "description": "Whether the agent discovered the source autonomously during browsing.",
82
- "used_by_modules": [
83
- "PolicyEngine",
84
- "Telemetry"
85
- ],
86
- "source_ids": [
87
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
88
- "SRC_OPENAI_PROMPT_INJECTION_2026",
89
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
90
- ],
91
- "credibility": "high",
92
- "last_verified": "2026-03-28"
93
- },
94
- {
95
- "signal_id": "TS-06",
96
- "name": "artifact_kind",
97
- "category": "surface",
98
- "description": "Surface kind such as html, pdf, image, blob-viewer, annotation, tool-output, or download.",
99
- "used_by_modules": [
100
- "ArtifactSurfaceGuard"
101
- ],
102
- "source_ids": [
103
- "SRC_OWASP_PI_CHEATSHEET_2026",
104
- "SRC_ANTHROPIC_BROWSER_USE_2025",
105
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
106
- ],
107
- "credibility": "high",
108
- "last_verified": "2026-03-28"
109
- },
110
- {
111
- "signal_id": "TS-07",
112
- "name": "extraction_method",
113
- "category": "surface",
114
- "description": "How the content was obtained: DOM text, OCR, vision, metadata, file parser, tool return, or screenshot.",
115
- "used_by_modules": [
116
- "ArtifactSurfaceGuard",
117
- "PromptInjectionGuard"
118
- ],
119
- "source_ids": [
120
- "SRC_OWASP_PI_CHEATSHEET_2026",
121
- "SRC_ANTHROPIC_BROWSER_USE_2025",
122
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
123
- ],
124
- "credibility": "high",
125
- "last_verified": "2026-03-28"
126
- },
127
- {
128
- "signal_id": "TS-08",
129
- "name": "visibility_class",
130
- "category": "surface",
131
- "description": "Visible, hidden, metadata-only, annotation-only, or rendered-late content class.",
132
- "used_by_modules": [
133
- "PromptInjectionGuard",
134
- "ArtifactSurfaceGuard"
135
- ],
136
- "source_ids": [
137
- "SRC_OWASP_PI_CHEATSHEET_2026",
138
- "SRC_ANTHROPIC_BROWSER_USE_2025",
139
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
140
- ],
141
- "credibility": "high",
142
- "last_verified": "2026-03-28"
143
- },
144
- {
145
- "signal_id": "TS-09",
146
- "name": "render_time_phase",
147
- "category": "surface",
148
- "description": "Whether content existed at initial page load, after mutation, or after user/tool action.",
149
- "used_by_modules": [
150
- "ArtifactSurfaceGuard",
151
- "Telemetry"
152
- ],
153
- "source_ids": [
154
- "SRC_OWASP_PI_CHEATSHEET_2026",
155
- "SRC_ANTHROPIC_BROWSER_USE_2025",
156
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
157
- ],
158
- "credibility": "high",
159
- "last_verified": "2026-03-28"
160
- },
161
- {
162
- "signal_id": "TS-10",
163
- "name": "script_generated_flag",
164
- "category": "surface",
165
- "description": "Marks content generated or mutated by scripts or third-party widgets.",
166
- "used_by_modules": [
167
- "ArtifactSurfaceGuard"
168
- ],
169
- "source_ids": [
170
- "SRC_OWASP_PI_CHEATSHEET_2026",
171
- "SRC_ANTHROPIC_BROWSER_USE_2025",
172
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
173
- ],
174
- "credibility": "high",
175
- "last_verified": "2026-03-28"
176
- },
177
- {
178
- "signal_id": "TS-11",
179
- "name": "ocr_confidence",
180
- "category": "quality",
181
- "description": "Confidence score for OCR/vision extraction.",
182
- "used_by_modules": [
183
- "ArtifactSurfaceGuard"
184
- ],
185
- "source_ids": [
186
- "SRC_OWASP_PI_CHEATSHEET_2026",
187
- "SRC_ANTHROPIC_BROWSER_USE_2025",
188
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
189
- ],
190
- "credibility": "high",
191
- "last_verified": "2026-03-28"
192
- },
193
- {
194
- "signal_id": "TS-12",
195
- "name": "text_render_mismatch",
196
- "category": "quality",
197
- "description": "Difference measure between rendered view and extracted text layer.",
198
- "used_by_modules": [
199
- "ArtifactSurfaceGuard",
200
- "PromptInjectionGuard"
201
- ],
202
- "source_ids": [
203
- "SRC_OWASP_PI_CHEATSHEET_2026",
204
- "SRC_ANTHROPIC_BROWSER_USE_2025",
205
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
206
- ],
207
- "credibility": "high",
208
- "last_verified": "2026-03-28"
209
- },
210
- {
211
- "signal_id": "TS-13",
212
- "name": "metadata_channel",
213
- "category": "surface",
214
- "description": "Specific metadata field carrying content, such as title, alt text, EXIF, or file properties.",
215
- "used_by_modules": [
216
- "ArtifactSurfaceGuard"
217
- ],
218
- "source_ids": [
219
- "SRC_OWASP_PI_CHEATSHEET_2026",
220
- "SRC_ANTHROPIC_BROWSER_USE_2025",
221
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
222
- ],
223
- "credibility": "high",
224
- "last_verified": "2026-03-28"
225
- },
226
- {
227
- "signal_id": "TS-14",
228
- "name": "auth_required_flag",
229
- "category": "trust",
230
- "description": "Whether access required authentication, which changes trust and sink rules.",
231
- "used_by_modules": [
232
- "PolicyEngine",
233
- "CredentialBroker"
234
- ],
235
- "source_ids": [
236
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
237
- "SRC_OPENAI_PROMPT_INJECTION_2026",
238
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
239
- ],
240
- "credibility": "high",
241
- "last_verified": "2026-03-28"
242
- },
243
- {
244
- "signal_id": "TS-15",
245
- "name": "credential_scope",
246
- "category": "trust",
247
- "description": "Scope and audience of credentials attached to the current tool or origin.",
248
- "used_by_modules": [
249
- "ToolProtocolGuard",
250
- "CredentialBroker"
251
- ],
252
- "source_ids": [
253
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
254
- "SRC_OPENAI_PROMPT_INJECTION_2026",
255
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
256
- ],
257
- "credibility": "high",
258
- "last_verified": "2026-03-28"
259
- },
260
- {
261
- "signal_id": "TS-16",
262
- "name": "taint_class",
263
- "category": "risk",
264
- "description": "Untrusted, user-provided, tool-derived, policy-derived, or secret-bearing taint label.",
265
- "used_by_modules": [
266
- "ActionIntegrityFirewall",
267
- "MemoryGuard"
268
- ],
269
- "source_ids": [
270
- "SRC_OWASP_PI_CHEATSHEET_2026",
271
- "SRC_ANTHROPIC_BROWSER_USE_2025",
272
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
273
- ],
274
- "credibility": "high",
275
- "last_verified": "2026-03-28"
276
- },
277
- {
278
- "signal_id": "TS-17",
279
- "name": "sensitivity_class",
280
- "category": "risk",
281
- "description": "Public, internal, confidential, regulated, credential, or destructive-operation class.",
282
- "used_by_modules": [
283
- "ActionIntegrityFirewall",
284
- "PolicyEngine"
285
- ],
286
- "source_ids": [
287
- "SRC_OWASP_PI_CHEATSHEET_2026",
288
- "SRC_ANTHROPIC_BROWSER_USE_2025",
289
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
290
- ],
291
- "credibility": "high",
292
- "last_verified": "2026-03-28"
293
- },
294
- {
295
- "signal_id": "TS-18",
296
- "name": "approval_binding_id",
297
- "category": "control",
298
- "description": "Structured ID linking actions to explicit approvals rather than natural-language memory.",
299
- "used_by_modules": [
300
- "PolicyEngine",
301
- "ActionIntegrityFirewall"
302
- ],
303
- "source_ids": [
304
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
305
- "SRC_OPENAI_PROMPT_INJECTION_2026",
306
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
307
- ],
308
- "credibility": "high",
309
- "last_verified": "2026-03-28"
310
- },
311
- {
312
- "signal_id": "TS-19",
313
- "name": "task_phase",
314
- "category": "control",
315
- "description": "Current phase such as discover, extract, compare, draft, or act.",
316
- "used_by_modules": [
317
- "ActionIntegrityFirewall",
318
- "PolicyEngine"
319
- ],
320
- "source_ids": [
321
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
322
- "SRC_OPENAI_PROMPT_INJECTION_2026",
323
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
324
- ],
325
- "credibility": "high",
326
- "last_verified": "2026-03-28"
327
- },
328
- {
329
- "signal_id": "TS-20",
330
- "name": "policy_pack",
331
- "category": "control",
332
- "description": "Policy pack currently active for the session or origin pair.",
333
- "used_by_modules": [
334
- "PolicyEngine",
335
- "Telemetry"
336
- ],
337
- "source_ids": [
338
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
339
- "SRC_OPENAI_PROMPT_INJECTION_2026",
340
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
341
- ],
342
- "credibility": "high",
343
- "last_verified": "2026-03-28"
344
- },
345
- {
346
- "signal_id": "TS-21",
347
- "name": "lineage_chain",
348
- "category": "provenance",
349
- "description": "Chain of transformations from source to summary to memory to action input.",
350
- "used_by_modules": [
351
- "ObservationSanitizer",
352
- "MemoryGuard"
353
- ],
354
- "source_ids": [
355
- "SRC_OWASP_PI_CHEATSHEET_2026",
356
- "SRC_ANTHROPIC_BROWSER_USE_2025",
357
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
358
- ],
359
- "credibility": "high",
360
- "last_verified": "2026-03-28"
361
- },
362
- {
363
- "signal_id": "TS-22",
364
- "name": "citation_or_source_ref",
365
- "category": "provenance",
366
- "description": "Reference back to the artifact or source object used to produce an observation.",
367
- "used_by_modules": [
368
- "ObservationSanitizer",
369
- "Replay"
370
- ],
371
- "source_ids": [
372
- "SRC_OWASP_PI_CHEATSHEET_2026",
373
- "SRC_ANTHROPIC_BROWSER_USE_2025",
374
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
375
- ],
376
- "credibility": "high",
377
- "last_verified": "2026-03-28"
378
- },
379
- {
380
- "signal_id": "TS-23",
381
- "name": "integrity_hash",
382
- "category": "provenance",
383
- "description": "Hash of artifact, memory object, or tool manifest used for rollback and comparison.",
384
- "used_by_modules": [
385
- "MemoryGuard",
386
- "Replay"
387
- ],
388
- "source_ids": [
389
- "SRC_OWASP_PI_CHEATSHEET_2026",
390
- "SRC_ANTHROPIC_BROWSER_USE_2025",
391
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
392
- ],
393
- "credibility": "high",
394
- "last_verified": "2026-03-28"
395
- },
396
- {
397
- "signal_id": "TS-24",
398
- "name": "freshness_timestamp",
399
- "category": "provenance",
400
- "description": "Timestamp indicating when the content or policy assertion was last fetched/validated.",
401
- "used_by_modules": [
402
- "PolicyEngine",
403
- "Replay"
404
- ],
405
- "source_ids": [
406
- "SRC_OWASP_PI_CHEATSHEET_2026",
407
- "SRC_ANTHROPIC_BROWSER_USE_2025",
408
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
409
- ],
410
- "credibility": "high",
411
- "last_verified": "2026-03-28"
412
- },
413
- {
414
- "signal_id": "TS-25",
415
- "name": "confidence_class",
416
- "category": "quality",
417
- "description": "High/medium/low confidence used to determine escalation or human review.",
418
- "used_by_modules": [
419
- "PolicyEngine",
420
- "PromptInjectionGuard"
421
- ],
422
- "source_ids": [
423
- "SRC_OWASP_PI_CHEATSHEET_2026",
424
- "SRC_ANTHROPIC_BROWSER_USE_2025",
425
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
426
- ],
427
- "credibility": "high",
428
- "last_verified": "2026-03-28"
429
- },
430
- {
431
- "signal_id": "TS-26",
432
- "name": "risk_score",
433
- "category": "risk",
434
- "description": "Composite risk score synthesized from deterministic rules and optional critics.",
435
- "used_by_modules": [
436
- "PolicyEngine",
437
- "IncidentResponse"
438
- ],
439
- "source_ids": [
440
- "SRC_OWASP_PI_CHEATSHEET_2026",
441
- "SRC_ANTHROPIC_BROWSER_USE_2025",
442
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
443
- ],
444
- "credibility": "high",
445
- "last_verified": "2026-03-28"
446
- },
447
- {
448
- "signal_id": "TS-27",
449
- "name": "sink_type",
450
- "category": "risk",
451
- "description": "Type of external effect: navigate, transmit, upload, send, mutate, execute, consent.",
452
- "used_by_modules": [
453
- "ActionIntegrityFirewall"
454
- ],
455
- "source_ids": [
456
- "SRC_OWASP_PI_CHEATSHEET_2026",
457
- "SRC_ANTHROPIC_BROWSER_USE_2025",
458
- "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
459
- ],
460
- "credibility": "high",
461
- "last_verified": "2026-03-28"
462
- },
463
- {
464
- "signal_id": "TS-28",
465
- "name": "origin_pair",
466
- "category": "origin",
467
- "description": "Normalized source-target origin pair for cross-origin controls.",
468
- "used_by_modules": [
469
- "ActionIntegrityFirewall"
470
- ],
471
- "source_ids": [
472
- "SRC_GOOGLE_CHROME_AGENTIC_2025",
473
- "SRC_OPENAI_PROMPT_INJECTION_2026",
474
- "SRC_OWASP_SECURE_MCP_GUIDE_2026"
475
- ],
476
- "credibility": "high",
477
- "last_verified": "2026-03-28"
478
- }
479
- ]
480
- }
1
+ {
2
+ "kb_meta": {
3
+ "name": "SafeBrowse vf trust signals and provenance catalog",
4
+ "version": "vf-final",
5
+ "generated_on": "2026-03-28",
6
+ "entry_count": 28,
7
+ "purpose": "Canonical trust/provenance fields shared across all modules."
8
+ },
9
+ "signals": [
10
+ {
11
+ "signal_id": "TS-01",
12
+ "name": "source_origin",
13
+ "category": "origin",
14
+ "description": "Canonical origin or site that supplied the observation or action target.",
15
+ "used_by_modules": [
16
+ "ActionIntegrityFirewall",
17
+ "ObservationSanitizer"
18
+ ],
19
+ "source_ids": [
20
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
21
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
22
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
23
+ ],
24
+ "credibility": "high",
25
+ "last_verified": "2026-03-28"
26
+ },
27
+ {
28
+ "signal_id": "TS-02",
29
+ "name": "frame_origin",
30
+ "category": "origin",
31
+ "description": "Origin of the specific frame, iframe, or embed where content appeared.",
32
+ "used_by_modules": [
33
+ "ActionIntegrityFirewall",
34
+ "ArtifactSurfaceGuard"
35
+ ],
36
+ "source_ids": [
37
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
38
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
39
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
40
+ ],
41
+ "credibility": "high",
42
+ "last_verified": "2026-03-28"
43
+ },
44
+ {
45
+ "signal_id": "TS-03",
46
+ "name": "same_origin_relation",
47
+ "category": "origin",
48
+ "description": "Whether content/action stays same-origin, same-site, cross-site, or cross-channel.",
49
+ "used_by_modules": [
50
+ "ActionIntegrityFirewall"
51
+ ],
52
+ "source_ids": [
53
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
54
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
55
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
56
+ ],
57
+ "credibility": "high",
58
+ "last_verified": "2026-03-28"
59
+ },
60
+ {
61
+ "signal_id": "TS-04",
62
+ "name": "user_shared_flag",
63
+ "category": "trust",
64
+ "description": "Whether the user explicitly shared or selected this source in the current session.",
65
+ "used_by_modules": [
66
+ "ObservationSanitizer",
67
+ "PolicyEngine"
68
+ ],
69
+ "source_ids": [
70
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
71
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
72
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
73
+ ],
74
+ "credibility": "high",
75
+ "last_verified": "2026-03-28"
76
+ },
77
+ {
78
+ "signal_id": "TS-05",
79
+ "name": "session_discovered_flag",
80
+ "category": "trust",
81
+ "description": "Whether the agent discovered the source autonomously during browsing.",
82
+ "used_by_modules": [
83
+ "PolicyEngine",
84
+ "Telemetry"
85
+ ],
86
+ "source_ids": [
87
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
88
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
89
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
90
+ ],
91
+ "credibility": "high",
92
+ "last_verified": "2026-03-28"
93
+ },
94
+ {
95
+ "signal_id": "TS-06",
96
+ "name": "artifact_kind",
97
+ "category": "surface",
98
+ "description": "Surface kind such as html, pdf, image, blob-viewer, annotation, tool-output, or download.",
99
+ "used_by_modules": [
100
+ "ArtifactSurfaceGuard"
101
+ ],
102
+ "source_ids": [
103
+ "SRC_OWASP_PI_CHEATSHEET_2026",
104
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
105
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
106
+ ],
107
+ "credibility": "high",
108
+ "last_verified": "2026-03-28"
109
+ },
110
+ {
111
+ "signal_id": "TS-07",
112
+ "name": "extraction_method",
113
+ "category": "surface",
114
+ "description": "How the content was obtained: DOM text, OCR, vision, metadata, file parser, tool return, or screenshot.",
115
+ "used_by_modules": [
116
+ "ArtifactSurfaceGuard",
117
+ "PromptInjectionGuard"
118
+ ],
119
+ "source_ids": [
120
+ "SRC_OWASP_PI_CHEATSHEET_2026",
121
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
122
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
123
+ ],
124
+ "credibility": "high",
125
+ "last_verified": "2026-03-28"
126
+ },
127
+ {
128
+ "signal_id": "TS-08",
129
+ "name": "visibility_class",
130
+ "category": "surface",
131
+ "description": "Visible, hidden, metadata-only, annotation-only, or rendered-late content class.",
132
+ "used_by_modules": [
133
+ "PromptInjectionGuard",
134
+ "ArtifactSurfaceGuard"
135
+ ],
136
+ "source_ids": [
137
+ "SRC_OWASP_PI_CHEATSHEET_2026",
138
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
139
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
140
+ ],
141
+ "credibility": "high",
142
+ "last_verified": "2026-03-28"
143
+ },
144
+ {
145
+ "signal_id": "TS-09",
146
+ "name": "render_time_phase",
147
+ "category": "surface",
148
+ "description": "Whether content existed at initial page load, after mutation, or after user/tool action.",
149
+ "used_by_modules": [
150
+ "ArtifactSurfaceGuard",
151
+ "Telemetry"
152
+ ],
153
+ "source_ids": [
154
+ "SRC_OWASP_PI_CHEATSHEET_2026",
155
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
156
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
157
+ ],
158
+ "credibility": "high",
159
+ "last_verified": "2026-03-28"
160
+ },
161
+ {
162
+ "signal_id": "TS-10",
163
+ "name": "script_generated_flag",
164
+ "category": "surface",
165
+ "description": "Marks content generated or mutated by scripts or third-party widgets.",
166
+ "used_by_modules": [
167
+ "ArtifactSurfaceGuard"
168
+ ],
169
+ "source_ids": [
170
+ "SRC_OWASP_PI_CHEATSHEET_2026",
171
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
172
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
173
+ ],
174
+ "credibility": "high",
175
+ "last_verified": "2026-03-28"
176
+ },
177
+ {
178
+ "signal_id": "TS-11",
179
+ "name": "ocr_confidence",
180
+ "category": "quality",
181
+ "description": "Confidence score for OCR/vision extraction.",
182
+ "used_by_modules": [
183
+ "ArtifactSurfaceGuard"
184
+ ],
185
+ "source_ids": [
186
+ "SRC_OWASP_PI_CHEATSHEET_2026",
187
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
188
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
189
+ ],
190
+ "credibility": "high",
191
+ "last_verified": "2026-03-28"
192
+ },
193
+ {
194
+ "signal_id": "TS-12",
195
+ "name": "text_render_mismatch",
196
+ "category": "quality",
197
+ "description": "Difference measure between rendered view and extracted text layer.",
198
+ "used_by_modules": [
199
+ "ArtifactSurfaceGuard",
200
+ "PromptInjectionGuard"
201
+ ],
202
+ "source_ids": [
203
+ "SRC_OWASP_PI_CHEATSHEET_2026",
204
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
205
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
206
+ ],
207
+ "credibility": "high",
208
+ "last_verified": "2026-03-28"
209
+ },
210
+ {
211
+ "signal_id": "TS-13",
212
+ "name": "metadata_channel",
213
+ "category": "surface",
214
+ "description": "Specific metadata field carrying content, such as title, alt text, EXIF, or file properties.",
215
+ "used_by_modules": [
216
+ "ArtifactSurfaceGuard"
217
+ ],
218
+ "source_ids": [
219
+ "SRC_OWASP_PI_CHEATSHEET_2026",
220
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
221
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
222
+ ],
223
+ "credibility": "high",
224
+ "last_verified": "2026-03-28"
225
+ },
226
+ {
227
+ "signal_id": "TS-14",
228
+ "name": "auth_required_flag",
229
+ "category": "trust",
230
+ "description": "Whether access required authentication, which changes trust and sink rules.",
231
+ "used_by_modules": [
232
+ "PolicyEngine",
233
+ "CredentialBroker"
234
+ ],
235
+ "source_ids": [
236
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
237
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
238
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
239
+ ],
240
+ "credibility": "high",
241
+ "last_verified": "2026-03-28"
242
+ },
243
+ {
244
+ "signal_id": "TS-15",
245
+ "name": "credential_scope",
246
+ "category": "trust",
247
+ "description": "Scope and audience of credentials attached to the current tool or origin.",
248
+ "used_by_modules": [
249
+ "ToolProtocolGuard",
250
+ "CredentialBroker"
251
+ ],
252
+ "source_ids": [
253
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
254
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
255
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
256
+ ],
257
+ "credibility": "high",
258
+ "last_verified": "2026-03-28"
259
+ },
260
+ {
261
+ "signal_id": "TS-16",
262
+ "name": "taint_class",
263
+ "category": "risk",
264
+ "description": "Untrusted, user-provided, tool-derived, policy-derived, or secret-bearing taint label.",
265
+ "used_by_modules": [
266
+ "ActionIntegrityFirewall",
267
+ "MemoryGuard"
268
+ ],
269
+ "source_ids": [
270
+ "SRC_OWASP_PI_CHEATSHEET_2026",
271
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
272
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
273
+ ],
274
+ "credibility": "high",
275
+ "last_verified": "2026-03-28"
276
+ },
277
+ {
278
+ "signal_id": "TS-17",
279
+ "name": "sensitivity_class",
280
+ "category": "risk",
281
+ "description": "Public, internal, confidential, regulated, credential, or destructive-operation class.",
282
+ "used_by_modules": [
283
+ "ActionIntegrityFirewall",
284
+ "PolicyEngine"
285
+ ],
286
+ "source_ids": [
287
+ "SRC_OWASP_PI_CHEATSHEET_2026",
288
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
289
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
290
+ ],
291
+ "credibility": "high",
292
+ "last_verified": "2026-03-28"
293
+ },
294
+ {
295
+ "signal_id": "TS-18",
296
+ "name": "approval_binding_id",
297
+ "category": "control",
298
+ "description": "Structured ID linking actions to explicit approvals rather than natural-language memory.",
299
+ "used_by_modules": [
300
+ "PolicyEngine",
301
+ "ActionIntegrityFirewall"
302
+ ],
303
+ "source_ids": [
304
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
305
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
306
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
307
+ ],
308
+ "credibility": "high",
309
+ "last_verified": "2026-03-28"
310
+ },
311
+ {
312
+ "signal_id": "TS-19",
313
+ "name": "task_phase",
314
+ "category": "control",
315
+ "description": "Current phase such as discover, extract, compare, draft, or act.",
316
+ "used_by_modules": [
317
+ "ActionIntegrityFirewall",
318
+ "PolicyEngine"
319
+ ],
320
+ "source_ids": [
321
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
322
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
323
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
324
+ ],
325
+ "credibility": "high",
326
+ "last_verified": "2026-03-28"
327
+ },
328
+ {
329
+ "signal_id": "TS-20",
330
+ "name": "policy_pack",
331
+ "category": "control",
332
+ "description": "Policy pack currently active for the session or origin pair.",
333
+ "used_by_modules": [
334
+ "PolicyEngine",
335
+ "Telemetry"
336
+ ],
337
+ "source_ids": [
338
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
339
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
340
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
341
+ ],
342
+ "credibility": "high",
343
+ "last_verified": "2026-03-28"
344
+ },
345
+ {
346
+ "signal_id": "TS-21",
347
+ "name": "lineage_chain",
348
+ "category": "provenance",
349
+ "description": "Chain of transformations from source to summary to memory to action input.",
350
+ "used_by_modules": [
351
+ "ObservationSanitizer",
352
+ "MemoryGuard"
353
+ ],
354
+ "source_ids": [
355
+ "SRC_OWASP_PI_CHEATSHEET_2026",
356
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
357
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
358
+ ],
359
+ "credibility": "high",
360
+ "last_verified": "2026-03-28"
361
+ },
362
+ {
363
+ "signal_id": "TS-22",
364
+ "name": "citation_or_source_ref",
365
+ "category": "provenance",
366
+ "description": "Reference back to the artifact or source object used to produce an observation.",
367
+ "used_by_modules": [
368
+ "ObservationSanitizer",
369
+ "Replay"
370
+ ],
371
+ "source_ids": [
372
+ "SRC_OWASP_PI_CHEATSHEET_2026",
373
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
374
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
375
+ ],
376
+ "credibility": "high",
377
+ "last_verified": "2026-03-28"
378
+ },
379
+ {
380
+ "signal_id": "TS-23",
381
+ "name": "integrity_hash",
382
+ "category": "provenance",
383
+ "description": "Hash of artifact, memory object, or tool manifest used for rollback and comparison.",
384
+ "used_by_modules": [
385
+ "MemoryGuard",
386
+ "Replay"
387
+ ],
388
+ "source_ids": [
389
+ "SRC_OWASP_PI_CHEATSHEET_2026",
390
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
391
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
392
+ ],
393
+ "credibility": "high",
394
+ "last_verified": "2026-03-28"
395
+ },
396
+ {
397
+ "signal_id": "TS-24",
398
+ "name": "freshness_timestamp",
399
+ "category": "provenance",
400
+ "description": "Timestamp indicating when the content or policy assertion was last fetched/validated.",
401
+ "used_by_modules": [
402
+ "PolicyEngine",
403
+ "Replay"
404
+ ],
405
+ "source_ids": [
406
+ "SRC_OWASP_PI_CHEATSHEET_2026",
407
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
408
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
409
+ ],
410
+ "credibility": "high",
411
+ "last_verified": "2026-03-28"
412
+ },
413
+ {
414
+ "signal_id": "TS-25",
415
+ "name": "confidence_class",
416
+ "category": "quality",
417
+ "description": "High/medium/low confidence used to determine escalation or human review.",
418
+ "used_by_modules": [
419
+ "PolicyEngine",
420
+ "PromptInjectionGuard"
421
+ ],
422
+ "source_ids": [
423
+ "SRC_OWASP_PI_CHEATSHEET_2026",
424
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
425
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
426
+ ],
427
+ "credibility": "high",
428
+ "last_verified": "2026-03-28"
429
+ },
430
+ {
431
+ "signal_id": "TS-26",
432
+ "name": "risk_score",
433
+ "category": "risk",
434
+ "description": "Composite risk score synthesized from deterministic rules and optional critics.",
435
+ "used_by_modules": [
436
+ "PolicyEngine",
437
+ "IncidentResponse"
438
+ ],
439
+ "source_ids": [
440
+ "SRC_OWASP_PI_CHEATSHEET_2026",
441
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
442
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
443
+ ],
444
+ "credibility": "high",
445
+ "last_verified": "2026-03-28"
446
+ },
447
+ {
448
+ "signal_id": "TS-27",
449
+ "name": "sink_type",
450
+ "category": "risk",
451
+ "description": "Type of external effect: navigate, transmit, upload, send, mutate, execute, consent.",
452
+ "used_by_modules": [
453
+ "ActionIntegrityFirewall"
454
+ ],
455
+ "source_ids": [
456
+ "SRC_OWASP_PI_CHEATSHEET_2026",
457
+ "SRC_ANTHROPIC_BROWSER_USE_2025",
458
+ "SRC_OWASP_AGENT_MEMORY_GUARD_2026"
459
+ ],
460
+ "credibility": "high",
461
+ "last_verified": "2026-03-28"
462
+ },
463
+ {
464
+ "signal_id": "TS-28",
465
+ "name": "origin_pair",
466
+ "category": "origin",
467
+ "description": "Normalized source-target origin pair for cross-origin controls.",
468
+ "used_by_modules": [
469
+ "ActionIntegrityFirewall"
470
+ ],
471
+ "source_ids": [
472
+ "SRC_GOOGLE_CHROME_AGENTIC_2025",
473
+ "SRC_OPENAI_PROMPT_INJECTION_2026",
474
+ "SRC_OWASP_SECURE_MCP_GUIDE_2026"
475
+ ],
476
+ "credibility": "high",
477
+ "last_verified": "2026-03-28"
478
+ }
479
+ ]
480
+ }