agent-threat-rules 3.5.11 → 4.0.0

package/README.md

@@ -13,7 +13,7 @@ AI Agent 威脅偵測規則的開放格式
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-ATR%20Scan-2ea44f?style=flat-square&logo=github)](https://github.com/marketplace/actions/atr-scan)
 [![License: MIT](https://img.shields.io/badge/license-MIT-brightgreen?style=flat-square)](LICENSE)
 [![DOI](https://img.shields.io/badge/DOI-10.5281%2Fzenodo.19178002-blue?style=flat-square)](https://doi.org/10.5281/zenodo.19178002)
-[![Rules](https://img.shields.io/badge/rules-751-blue?style=flat-square)](#5-specification)
+[![Rules](https://img.shields.io/badge/rules-785-blue?style=flat-square)](#5-specification)
 [![Categories](https://img.shields.io/badge/categories-10-blue?style=flat-square)](#7-coverage)
 [![OWASP Agentic](https://img.shields.io/badge/OWASP_Agentic_Top_10-10%2F10-brightgreen?style=flat-square)](#7-coverage)
 [![SAFE-MCP](https://img.shields.io/badge/SAFE--MCP-91.8%25-brightgreen?style=flat-square)](#7-coverage)
@@ -29,7 +29,7 @@ ATR (Agent Threat Rules) is an open detection rule format for AI agent security
 
 ## Status of This Document
 
-ATR is published as a **Working Draft** at version `3.0.0-alpha.1`. The rule format defined in `ATR-SPEC-v1.md` is stable and shipped in production at Microsoft, Cisco, and Gen Digital, and in standards-body integrations (MISP / CIRCL, OWASP Agent Security Regression Harness, SigmaHQ, FINOS Common Cloud Controls); full list with PR links in [§6 Adoption](#6-adoption). Governance is currently single-maintainer (BDFL) transitioning to a Technical Steering Committee per [GOVERNANCE.md](GOVERNANCE.md).
+ATR is published as a **Working Draft** at version `3.0.0-alpha.1`. The rule format defined in `SPEC.md` is stable and merged into open-source repos at Microsoft, Cisco, and Gen Digital, and integrated by standards-body projects (MISP / CIRCL, OWASP Agent Security Regression Harness, SigmaHQ, FINOS Common Cloud Controls); full list with PR links in [§6 Adoption](#6-adoption). Governance is currently single-maintainer (BDFL) transitioning to a Technical Steering Committee per [GOVERNANCE.md](GOVERNANCE.md).
 
 All numbers in this document are sourced from [`data/stats.json`](data/stats.json), which is the canonical record of the project's current state. Where this README and `stats.json` disagree, `stats.json` is authoritative.
 
@@ -94,12 +94,12 @@ ATR fills the gap between *taxonomy* and *deployable rule*. Each rule is a YAML
 
 ## 2. Conformance Levels
 
-The keywords MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in this document and in [`ATR-SPEC-v1.md`](ATR-SPEC-v1.md) are to be interpreted as described in [RFC 2119](https://datatracker.ietf.org/doc/html/rfc2119).
+The keywords MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in this document and in [`SPEC.md`](SPEC.md) are to be interpreted as described in [RFC 2119](https://datatracker.ietf.org/doc/html/rfc2119).
 
 A conforming **ATR engine** MUST:
 
 1. Parse all fields defined in [`spec/atr-schema.yaml`](spec/atr-schema.yaml) without error.
-2. Evaluate `detection.conditions` with the semantics defined in [`ATR-SPEC-v1.md`](ATR-SPEC-v1.md) §3.5 (Detection Logic) and §5 (Engine Requirements).
+2. Evaluate `detection.conditions` with the semantics defined in [`SPEC.md`](SPEC.md) §6 (Detection Semantics).
 3. Honor the `scan_target` field — a rule with `scan_target: skill` MUST NOT be evaluated against `mcp_exchange` events and vice versa.
 4. Respect rule `status` — rules with `status: deprecated` or `status: draft` MUST NOT participate in production matching unless the consumer opts in explicitly.
 5. Emit `rule_id` and rule `severity` on every match.
@@ -203,29 +203,118 @@ matches = engine.evaluate(AgentEvent(content="...", event_type="llm_input"))
 | MCP server | Live integration with Claude Code, Cursor, Windsurf, and other MCP clients |
 | Splunk / Elastic export | SIEM rule pack for runtime detection |
 
-### Detection lanes (v3.5.0)
+### Detection lanes
+
+A lane selects which rules may fire. It is one of the two runtime switches; the
+other is blocking, which decides whether ATR may act on what fired, and which
+the next section covers. Neither implies the other.
+[docs/ENFORCEMENT-MODEL.md](docs/ENFORCEMENT-MODEL.md) is the full reference.
 
 Each rule carries a maturity-driven **lane**, so a consumer can trade recall for precision instead of running every rule at one fixed threshold:
 
 | Lane | Fires | Intended use | FP on a 65K-sample benign gate |
 |---|---|---|---:|
-| `enforce` | `stable` rules behind an embedding `confirm` guard | Auto-block | ~0.24% |
+| `enforce` | `stable` only | Narrowest, highest-precision set — the one to run when blocking is on | ~0.24% |
 | `alert` | `stable` + `test` | Analyst / correlation | — |
-| `hunt` | all rules except `deprecated` | Advisory / eval (**default**) | ~9% |
+| `hunt` | all rules except `deprecated` | Broadest visibility (**default**) | ~9% |
+
+Lanes are opt-in and backward-compatible for detection: the default is `hunt`, so every integration sees exactly the rules it saw before. Selecting `enforce` raises precision by firing only the most mature rules — and therefore catches fewer attacks. Report false-positive rates lane-keyed (`enforce` ~0.24% / `hunt` ~9% on the 65K-sample benign gate), not as a single overall figure. That gate is a separate corpus from the per-source measurements in [§8 Evaluation](#8-evaluation).
+
+### Detection and enforcement are separate switches
+
+Detection always runs. **Blocking is opt-in and off by default.** In the default
+mode `atr guard` reports what it found and changes nothing: it emits no
+permission decision to the host, and it dispatches no response action above the
+`observe` blast-radius tier (`alert` / `snapshot` / `shadow` / `escalate` still
+run). Turning blocking on is the explicit operator directive [SPEC.md](SPEC.md)
+§5.5 requires before an engine may execute response actions automatically.
+([spec/atr-method-v1.1.md](spec/atr-method-v1.1.md) §5.6 says the same thing for
+hash matches specifically; §5.5 of SPEC.md is the engine-wide one.)
+
+**ATR never answers `permissionDecision: "allow"` — in either mode.** That
+decision is not neutral in the Claude Code contract; it is an affirmative
+approval that suppresses the host's own permission prompt, so answering it on
+every operation ATR had not looked for would make a hooked session permit *more*
+than an unhooked one. A permission decision is emitted only to **restrain** —
+`deny` or `ask` — and only with blocking on. Any other verdict omits the whole
+`hookSpecificOutput` envelope, and the finding travels in `atr_decision`,
+`atr_reason` and `matched_rules` instead. Turning blocking on does not bring the
+affirmative decision back.
+
+| Switch | CLI flag | Environment (CLI only) | Library config | Default |
+|---|---|---|---|---|
+| Detection lane | `--lane <enforce\|alert\|hunt>` | `ATR_LANE` | `new ATREngine({ lane })` | `hunt` |
+| Blocking | `--blocking` / `--no-blocking` | `ATR_BLOCKING` | `blocking` on `ActionExecutor` / `HookHandler` | off |
+
+**The two surfaces resolve differently, and they do not share a chain:**
+
+- **Library** — explicit config **>** built-in default. `ATREngine`,
+  `ActionExecutor` and `HookHandler` do not read the environment at all, so an
+  embedded engine cannot be re-pointed by a variable the host never set.
+- **CLI** — flag **>** environment variable **>** built-in default.
+
+An unrecognised `--lane` value is a usage error, never a silent fallback:
+`atr guard --lane enfroce` exits 1 with
+`Error: Invalid --lane "enfroce". Expected one of: enforce, alert, hunt.`
+An unrecognised value in the *environment* warns on stderr, falls back to the
+safe default and keeps running (exit 0), because `atr guard` runs as a Claude
+Code command hook where a non-zero exit discards every detection and prints no
+reason. If `ATR_LANE` is the variable that could not be read, blocking is forced
+off even when `--blocking` was passed — the fallback lane is the broadest one,
+and enforcing on a lane the operator never chose is the only degradation that
+would be more dangerous than the request.
+
+```bash
+atr guard                                 # advisory: report only (the default)
+atr guard --lane enforce --blocking       # blocking on, and only the 106 of 777
+                                          # live rules that are maturity: stable
+                                          # may fire (see the recall note below)
+ATR_LANE=enforce ATR_BLOCKING=1 atr guard # the same, via the environment
+```
+
+**`--lane enforce` costs recall, and the cost is large.** It loads only
+`maturity: stable` rules: **106 of the 777 live rules** in this repository at the
+commit this paragraph was written against. That is the trade being made every
+time enforcement is recommended alongside it — narrower firing set, lower
+false-positive rate, fewer attacks caught. Rule counts move daily, and a
+`grep`-based count is wrong here (eight rules quote the value as
+`maturity: "stable"`), so re-derive by parsing before quoting the figure
+anywhere:
 
-Lanes are opt-in and fully backward-compatible: the default is `hunt`, so existing integrations behave exactly as before. Selecting `enforce` raises precision by firing only the most mature rules — and therefore catches fewer attacks. Report false-positive rates lane-keyed (`enforce` ~0.24% / `hunt` ~9% on the 65K-sample benign gate), not as a single overall figure. That gate is a separate corpus from the per-source measurements in [§8 Evaluation](#8-evaluation).
+```bash
+python3 - <<'PY'
+import glob, yaml
+rules = [yaml.safe_load(open(p, encoding='utf-8'))
+         for p in glob.glob('rules/**/*.yaml', recursive=True)]
+live = [r for r in rules
+        if r.get('status') not in ('draft', 'deprecated')
+        and str(r.get('maturity') or '').strip() != 'deprecated']
+stable = [r for r in live if str(r.get('maturity') or '').strip() == 'stable']
+print(f'files={len(rules)} live={len(live)} enforce={len(stable)}')
+PY
+```
+
+Programmatic embedding: `new ATREngine({ lane })` for the lane,
+`new ActionExecutor({ adapter, blocking })` and
+`new HookHandler({ engine, executor, blocking })` for enforcement. **These are
+the only inputs** — the constructors ignore `ATR_LANE` and `ATR_BLOCKING`, so
+setting them will not configure an embedded engine. An unrecognised lane throws
+a `TypeError`, and so does a non-boolean `blocking`: `blocking: "false"` is a
+string, and every non-empty string is truthy, so it used to switch enforcement
+**on** while reading as an explicit "off".
 
 ## 5. Specification
 
 | Artifact | Path | Purpose |
 |---|---|---|
 | Specification (canonical pointer) | [SPEC.md](SPEC.md) | Resolves to the authoritative documents below |
-| Rule format spec (normative) | [ATR-SPEC-v1.md](ATR-SPEC-v1.md) | Rule format, identifier scheme, evaluation semantics |
+| Rule format spec (normative) | [SPEC.md](SPEC.md) | Rule format, identifier scheme, evaluation semantics |
 | Framework spec | [ATR-FRAMEWORK-SPEC.md](ATR-FRAMEWORK-SPEC.md) | Multi-layer detection framework design |
 | Machine-readable schema | [spec/atr-schema.yaml](spec/atr-schema.yaml) | Authoritative validation source |
 | Schema field reference | [docs/schema-spec.md](docs/schema-spec.md) | Human-readable schema docs |
 | Quality standard | [docs/QUALITY-STANDARD.md](docs/QUALITY-STANDARD.md) | Rule promotion criteria (experimental → stable) |
 | Quality gate | [docs/QUALITY-GATE.md](docs/QUALITY-GATE.md) | Safety-gate semantics for community PRs |
+| Enforcement model | [docs/ENFORCEMENT-MODEL.md](docs/ENFORCEMENT-MODEL.md) | Lane and blocking switches, decision channels, migration (reference implementation, not normative) |
 | Limitations | [LIMITATIONS.md](LIMITATIONS.md) | What ATR cannot detect; documented evasion techniques |
 | Threat model | [THREAT-MODEL.md](THREAT-MODEL.md) | Threat analysis driving the rule set |
 
@@ -361,63 +450,205 @@ Aggregated into [`data/stats.json`](data/stats.json) under `benchmarks[]`.
 | Source | Source version | Samples | Recall | Precision | FP rate | ATR version | Measured |
 |---|---|---:|---:|---:|---:|---|---|
 | AdvBench (LLM-attacks behaviors) | upstream-2026-06-16 | 520 | 2.1% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| atr-self-test | internal | 341 | 89.7% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
+| atr-self-test | internal | 341 | 96.6% | 100.0% | 0.0% | 3.5.12 | 2026-08-15 |
 | autoresearch | internal-1054 | 1,054 | 15.1% | 100.0% | 0.0% | 3.0.0-alpha.0 | 2026-05-23 |
-| garak (in-the-wild jailbreaks) | inthewild-jailbreak-corpus-650 | 650 | 97.2% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| garak-full (all probe families) | 23-families | 3,475 | 38.3% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
+| garak (in-the-wild jailbreaks) | inthewild-jailbreak-corpus-650 | 650 | 92.3% | 100.0% | 0.0% | 3.5.12 | 2026-08-15 |
+| garak-full (all probe families) | 23-families | 3,475 | 57.2% | 100.0% | 0.0% | 3.5.12 | 2026-08-15 |
 | hackaprompt | v1 | 4,780 | 69.6% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
 | HarmBench (CAIS behaviors) | upstream-2026-06-16 | 400 | 2.8% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| hh-rlhf (Anthropic red-team-attempts) | snapshot-2026-04 | 4,957 | 99.1% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
+| hh-rlhf (Anthropic red-team-attempts) [^stdcorpora] | snapshot-2026-04 | 4,957 | 1.5% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
 | JailbreakBench (JBB-Behaviors) | upstream-2026-06-16 | 100 | 6.0% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
 | llm-guard (Protect AI test fixtures) | corpus-2026-05-12 | 44 | 77.3% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| MITRE ATLAS | snapshot-2026-04 | 182 | 100.0% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
+| MITRE ATLAS [^stdcorpora] | snapshot-2026-04 | 182 | 39.0% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
 | NeMo Guardrails (NVIDIA test fixtures) | corpus-2026-05-12 | 6 | 100.0% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| OWASP LLM Top 10 | snapshot-2026-04 | 56 | 100.0% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| PINT-format (deepset + Lakera Gandalf) | public-850 | 850 | 63.6% | 99.7% | 0.25% | 3.5.0 | 2026-06-16 |
-| PromptBench (academic adversarial) | snapshot-2026-04 | 3,280 | 23.2% | 100.0% | 0.0% | 3.5.2 | 2026-06-25 |
+| OWASP LLM Top 10 [^stdcorpora] | snapshot-2026-04 | 56 | 16.1% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
+| PINT-format (deepset + Lakera Gandalf) [^pint] | v1 | 850 | 65.4% | 100.0% | 0.0% | 3.5.12 | 2026-08-15 |
+| PromptBench (academic adversarial) [^promptcorpora] | snapshot-2026-04 | 3,280 | 15.7% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
 | promptfoo (red-team plugin fixtures) | corpus-2026-05-12 | 44 | 97.7% | 100.0% | 0.0% | 3.5.0 | 2026-06-16 |
-| PromptInject (academic adversarial) | snapshot-2026-04 | 1,080 | 100.0% | 100.0% | 0.0% | 3.5.2 | 2026-06-25 |
-| SKILL.md benchmark (internal) | internal-498 | 498 | 100.0% | 97.0% | 0.20% | 3.5.0 | 2026-06-16 |
+| PromptInject (academic adversarial) [^promptcorpora] | snapshot-2026-04 | 1,080 | 100.0% | 100.0% | 0.0% | 3.5.11 | 2026-08-05 |
+| SKILL.md benchmark (internal) [^skilllane] | internal-498 | 498 | 100.0% (hunt) / 0.0% (enforce) | 97.0% | 0.20% | 3.5.12 | 2026-08-15 |
 | Wild scan (OpenClaw + Skills.sh + Hermes + ClawHub) | corpus-2026-04-14 | 96,096 | — | 57.7% (floor) | 1.35% flag rate | 2.0.0 | 2026-04-14 |
 
 All detection corpora were (re-)measured against ATR 3.5.0 on 2026-06-16,
 except `autoresearch` (an internal predicted-rule corpus with no standalone
 runner) and the `Wild scan` snapshot, which retain their earlier measurements.
+`PromptInject` and `PromptBench` were re-measured against ATR 3.5.11 on
+2026-08-05; see [^promptcorpora] for what moved and why. (An earlier
+re-measurement against 3.5.2 on 2026-06-25 fixed a harness event shape; the
+0.0% rows before that were a harness artifact — the harness placed the prompt
+in a top-level field the engine does not read — not the engine's actual
+result.)
+
 `PromptInject` and `PromptBench` were re-measured against ATR 3.5.2 on
 2026-06-25 after a fix to the recall-analysis harness event shape; the prior
 0.0% rows were a harness artifact (the harness placed the prompt in a
 top-level field the engine does not read), not the engine's actual result.
+`hh-rlhf`, `MITRE ATLAS` and `OWASP LLM Top 10` were re-measured against ATR
+3.5.11 on 2026-08-05 after their runner was found never to have called the
+engine at all — see [^stdcorpora]. Those three rows fell 99.1% → 1.5%,
+100.0% → 39.0% and 100.0% → 16.1%. Nothing regressed; the earlier numbers
+were never measurements of ATR.
 The per-row `ATR version` column above is the version each cell was actually
 measured against, mirroring the `atr_version` field in each
 `data/measurements/<source>/latest.json`. The headline `garak` recall moved
-98.0% → 97.2% in 3.5.0 because rule `ATR-2026-00495` (a garak DAN variant) was
-deprecated and no longer fires; see [CHANGELOG.md](CHANGELOG.md).
+98.0% (3.0.0) → 97.2% (3.5.0) → 95.7% (3.5.8) → 92.5% (3.5.11) → 92.3%
+(3.5.12). The 3.5.8 →
+3.5.11 step is a real loss of detections, not a change in how they are counted:
+PR #327 tightened an over-broad persona regex in `ATR-2026-00001` that had been
+false-positiving on benign "you are now an expert …" prose, and tightening it
+also gave up the recall that regex had been earning on novel-persona jailbreaks
+("you are now TrueGPT / ChatINF / Raven …"). The harness event shape changed in
+the same window (see below), and it is not the cause: replayed on 780
+rules, the old shape scores 92.2% and the corrected shape 92.5%, a 0.3-point
+difference in the corrected shape's favour. The 3.2-point drop from 95.7% is
+the rules. The 3.5.11 → 3.5.12 step is one prompt (600/650 vs 601/650) and
+should be read as noise, not as a trend.
+
+Two numbers that briefly appeared here are **withdrawn**: between 2026-08-04
+and 2026-08-05, this table and `stats.json` cited **91.5%** for `garak` and
+**56.9%** for `garak-full`, both at ATR 3.5.11. No measurement file for either
+run exists anywhere in the repository. `data/measurements/garak/latest.json`
+pointed, the entire time, at 95.7% measured on 3.5.8; `garak-full`'s pointed at
+38.3% on 3.5.0, while a never-referenced 3.5.8 file sat unread in the same
+directory. So the claims failed this project's own rule that every published
+number is a version-pinned, reproducible measurement. It was also produced by a harness
+that built an event of `type: 'llm_io'`, which is a rule *source* and not an
+`AgentEventType`; `src/engine.ts` could not map it and so ran every rule of
+every source against the event instead of the two source types the harness
+documented itself as using. The 92.3% above replaces it: measured on
+2026-08-15 at 784 rules through `llm_input` + `tool_response`, the two channels
+`src/hook-handler.ts` can actually deliver a prompt on, and written to
+`data/measurements/garak/2026-08-15_garak-inthewild-jailbreak-corpus-650_atr-3-5-12.json`
+with the commit that produced it. Under the wider shape set used for
+false-positive measurement (which also runs `engine.scanSkill()`) the same
+corpus scores 92.9%; that number is recorded in the measurement's `breakdown`
+and is deliberately not the published one, because a garak prompt never reaches
+production as a SKILL.md. `.github/workflows/eval.yml` now runs
+`scripts/check-benchmark-citations.ts`, which fails CI if this table or
+`stats.json` cites a number no measurement file backs.
+See [CHANGELOG.md](CHANGELOG.md).
+
+[^skilllane]: **Lane matters more here than anywhere else in this table.** The
+    100% figure is the `hunt` lane, which is the engine default and loads every
+    maturity. In the `enforce` lane — the auto-block one, where a detection stops
+    the agent with no human in the loop — this corpus scores **0%**, and the
+    reason is structural rather than a tuning problem: of the 38 rules carrying
+    `scan_target: skill`, **all 38 are `maturity: test`, and none is `stable`.**
+    The enforce lane only loads `stable`, so it loads no skill-scanning rule at
+    all, and 0 of 32 malicious samples fire. Anyone reading "100% recall on
+    SKILL.md" and deploying in enforce mode would be forming a completely wrong
+    expectation, so both numbers are shown. Verified on this commit with
+    `grep`-free counting over `rules/**/*.yaml`.
+
+[^pint]: The `PINT-format` row is **not** a run of Lakera's official PINT
+    benchmark. That corpus is private and roughly 5x larger; this row is a
+    self-built 850-sample corpus in PINT's format, assembled from
+    `deepset/prompt-injections` (660) and `Lakera/gandalf_ignore_instructions`
+    (190). It also carries a scope caveat worth stating plainly: only **63 of
+    784 rules** fire on it at all, and `ATR-2026-00001` alone accounts for 226
+    of the 295 detections. Read it as a prompt-injection-family score, not as
+    ATR's overall coverage. The row moved 63.6% → 60.3% between 3.5.0 and
+    3.5.11 for the same reason `garak` moved: PR #327 tightened
+    `ATR-2026-00001`'s persona-switch regex to stop it false-positiving on
+    benign prose. Precision moved 99.7% → 100% over the same span. It then
+    recovered 60.3% → 65.4% at 3.5.12 (2026-08-15) as rules added since
+    3.5.11 widened the family: rules firing on this corpus went 29 → 63 while
+    `ATR-2026-00001`'s own contribution stayed at 226, so the gain came from
+    the tail, not from re-loosening the one dominant rule. Precision held at
+    100% (0 FP on the 399 benign samples).
+
+[^promptcorpora]: **Read both of these as closed-book scores.** Until
+    2026-08-05 the harness recorded its per-rule breakdown as the literal
+    string `"unknown"` (it read `m.rule_id` off an engine match that carries
+    `m.rule.id`), so no published version of these rows could say which rules
+    produced them. With attribution restored:
+    **PromptInject 100.0%** is produced by **7 of 780 rules**. Five of those
+    seven — `ATR-2026-00506`, `00507`, `00508`, `00509`, `00518` — carry
+    `author: ATR Community (PromptInject corpus)`: they were written *from*
+    this corpus, which has four attack classes built from a handful of
+    templates. Remove those five and recall on the same 1,080 samples is
+    **9.7%**. The concentration is real but not fragile: the top rule
+    (`ATR-2026-00508`, 968/1,080 samples) is the sole detector on none of
+    them, so deleting it leaves recall at 100%; only `00518` (45 samples) and
+    `00507` (27) are sole detectors of anything. On the 5,352-sample benign
+    gate, `00506` / `00507` / `00518` are 0-FP; `00508` has 4 FP, `00509` 3,
+    `ATR-2026-00001` 19, `ATR-2026-00400` 1.
+    **PromptBench 15.7%** is produced by **3 of 780 rules** (`ATR-2026-00520`,
+    `00519`, `00202`), all three 0-FP on the same benign gate. Two of the three
+    were mined from PromptBench; without them recall is **2.4%**.
+    The PromptBench row moved 23.2% (3.5.2) → 15.7% (3.5.11) and the loss is
+    fully attributable: 247 samples were held only by rules that have since
+    been precision-repaired, and re-running each rule version by version pins
+    every one to its PR — `ATR-2026-00442` 304 → 0 detections at PR #309
+    (223 of them samples nothing else caught), `00051` 17 → 0 at #238 (15),
+    `00118` 6 → 0 at #238 (6), `00001` 3 → 0 at #327 (3). The PromptInject
+    row stayed at 100% across the same span, but what holds it up changed:
+    at 3.5.2 `ATR-2026-00118` matched 1,060 of the 1,080 samples and `00442`
+    another 195; #238 and #309 took both to zero. Neither fact was visible
+    while the breakdown said "unknown", and the row itself sat at its stale
+    3.5.2 value for the six weeks in between.
+    Both corpora are 100% adversarial, so the `Precision` and `FP rate`
+    columns are properties of the corpus, not measurements — read them
+    together with the benign-gate FP counts above, never alone.
+
+[^stdcorpora]: Until 2026-08-05 these three rows were **not produced by the ATR
+    engine**. `scripts/eval-std-corpora.ts` walked `rules/` with a YAML parser,
+    kept only `operator: regex` conditions, flattened every condition of every
+    rule into one implicit OR, and tested each pattern with its own
+    `new RegExp(value, 'i')` against the raw sample string. That shadow matcher
+    had no status gate (it counted `status: draft` rules the engine skips), no
+    lane gate, no field resolution (a condition declared on `tool_response` was
+    tested against natural-language prose), no `condition: all` handling, no
+    non-regex operators, and — the decisive defect — the wrong regex flags.
+    `src/engine.ts` compiles a pattern containing `\u{` with the `u` flag;
+    the shadow matcher always used `i`. Without `u`, the codepoint class
+    `[\u{E0001}\u{E007F}]` in `ATR-2026-00258` is read by JavaScript as the
+    literal character class `[u{E0017F}]` — "contains any of `u { E 0 1 } 7 F`"
+    — so it matched any English text containing the letter `e`. That single
+    miscompiled condition accounted for **4,914 of the 4,914 hh-rlhf
+    detections, 56 of 56 on OWASP, and 182 of 182 on ATLAS**; with it excluded
+    the same shadow matcher scored 0.2% / 3.6% / 8.8%. The old rows measured
+    how many samples contain a vowel. The runner now goes through `ATREngine`
+    and the canonical event shapes in `scripts/lib/corpus-event.ts` — the same
+    entry point the false-positive gates use. Reproduce with
+    `npx tsx scripts/eval-std-corpora.ts`. Read the new numbers with the same
+    scope caveat as `PINT-format`: on ATLAS, `ATR-2026-00061` alone accounts
+    for 59 of the 71 detections (32.4% of the corpus), and ATLAS procedures are
+    prose *descriptions* of attacks rather than attack payloads, so this row
+    measures ATR against attack write-ups, not against traffic.
 
 Two `garak` rows are deliberate: the headline `garak` source tracks NVIDIA's
-in-the-wild jailbreak corpus (narrow, the ~97% number ATR cites publicly,
-refreshed 2026-06-16 against ATR 3.5.0), while `garak-full` tracks
+in-the-wild jailbreak corpus (narrow, the ~92% number ATR cites publicly,
+refreshed 2026-08-15 against ATR 3.5.12), while `garak-full` tracks
 every probe family in upstream garak (broad, includes families like
 `badchars`, `dra`, `encoding` that ATR's regex layer intentionally does
 not target). Both are valid measurements against different corpora; they
 are kept as separate streams so the broad-corpus number does not silently
 overwrite the headline.
 
-The single-digit recall on AdvBench / HarmBench / JailbreakBench is honest
-and expected. Those three corpora test **LLM safety alignment** (does the
+The single-digit recall on AdvBench / HarmBench / JailbreakBench / hh-rlhf is
+honest and expected. Those four corpora test **LLM safety alignment** (does the
 model refuse harmful requests like "explain how to make a bomb"), not
 **prompt-injection detection** (the surface ATR's regex layer targets).
 ATR's near-zero recall on these corpora confirms the layering thesis:
 regex catches structured attack patterns, alignment + content moderation
 catch natural-language harm requests. The numbers are recorded for
 completeness and so any future ATR rule additions in the harm-category
-space can be measured against a documented baseline.
-
-Conventions: 100%-adversarial corpora have `fp_rate` undefined and recorded as
-0 in measurement files. Wild-scan has no ground-truth labels; the `precision`
-column reports a precision floor computed as `confirmed_malware / flagged`.
-Every cell is sourced from a specific measurement file — see
-`data/measurements/<source>/latest.json` for the file path and
-`metadata.measurement_file` in `stats.json` for the absolute repo path.
+space can be measured against a documented baseline. `hh-rlhf` is Anthropic's
+red-team-attempts set — the same genre as the other three — and its 1.5% now
+sits with their 2.1% / 2.8% / 6.0% instead of contradicting them at 99.1%.
+
+Conventions: 100%-adversarial corpora contain no benign samples, so they have
+no true-negative population and **`precision` and `fp_rate` cannot be computed
+from them**. The measurement schema requires numbers, so those rows record the
+convention `precision 1` / `fp_rate 0`. Read the `Precision` and `FP rate`
+columns as "not applicable to this corpus", not as results — the real
+precision numbers come from the benign gate, lane-keyed, below. Wild-scan has
+no ground-truth labels either; its `precision` column reports a precision floor
+computed as `confirmed_malware / flagged`. Every cell is sourced from a
+specific measurement file — see `data/measurements/<source>/latest.json` for
+the file path and `metadata.measurement_file` in `stats.json` for the absolute
+repo path.
 
 False-positive rate is lane-keyed as of v3.5.0, not a single overall figure.
 ATR ships detection lanes (`enforce` / `alert` / `hunt`); on a 65K-sample
@@ -533,7 +764,7 @@ The 96,096-skill ecosystem scan was made possible by the maintainers of OpenClaw
 ### Normative
 
 - [RFC 2119](https://datatracker.ietf.org/doc/html/rfc2119) — Key words for use in RFCs to Indicate Requirement Levels.
-- [ATR-SPEC-v1.md](ATR-SPEC-v1.md) — ATR rule format specification, v1.0 Draft.
+- [SPEC.md](SPEC.md) — ATR rule format specification, v1.0 Draft.
 - [spec/atr-schema.yaml](spec/atr-schema.yaml) — Authoritative machine-readable schema.
 
 ### Informative

package/dist/action-executor.d.ts

@@ -5,17 +5,58 @@
  * to a PlatformAdapter. Handles per-action errors so one failure
  * does not block the rest.
  *
+ * ENFORCEMENT GATE: actions above the OBSERVE blast-radius tier are dispatched
+ * only when the operator has enabled blocking (`blocking: true` here; the CLI
+ * maps ATR_BLOCKING / `atr guard --blocking` onto it). Without it they are
+ * recorded as suppressed and the adapter is never called. See
+ * src/enforcement.ts for why this is opt-in and
+ * src/quality/action-eligibility.ts for the tier ladder this gate reads.
+ *
  * @module agent-threat-rules/action-executor
  */
-import type { ActionResult, ExecutionContext, PlatformAdapter } from "./types.js";
+import type { ATRAction, ActionResult, ExecutionContext, PlatformAdapter } from "./types.js";
+/**
+ * Map action names to PlatformAdapter method names.
+ *
+ * Exported because it is the authoritative list of actions this engine can
+ * actually dispatch. Rule files also carry SPEC Appendix A vocabulary
+ * (`revoke_credential`, `quarantine_artifact`, ...) that has no entry here and
+ * therefore never reaches an adapter — see executeOne's "Unknown action" branch.
+ * src/quality/action-eligibility.ts ranks exactly these keys by blast radius, and
+ * tests/action-eligibility.test.ts pins the two sets equal, so implementing a new
+ * adapter method forces an explicit decision about how destructive it is.
+ */
+export declare const ACTION_METHOD_MAP: Readonly<Record<ATRAction, keyof PlatformAdapter>>;
 export interface ActionExecutorConfig {
     readonly adapter: PlatformAdapter;
     readonly dryRun?: boolean;
+    /**
+     * Operator directive permitting enforcement actions. OFF BY DEFAULT.
+     *
+     * When false, any action above the OBSERVE blast-radius tier
+     * (block_input / block_output / block_tool / reduce_permissions /
+     * reset_context / quarantine_session / kill_agent) is refused before the
+     * adapter is touched; OBSERVE actions (alert / snapshot / shadow / escalate)
+     * run exactly as before.
+     *
+     * This field is the only input — the executor does not read `ATR_BLOCKING`.
+     * A non-boolean throws rather than being coerced: `blocking: "false"` is
+     * truthy in JavaScript and would otherwise enable enforcement. `atr guard`
+     * resolves the environment itself and passes the result here.
+     *
+     * This is the runtime half of SPEC.md §5.5 ("Engines MUST NOT execute
+     * response actions automatically without an explicit configuration directive
+     * from the operator"). Until it existed, `atr guard` built an executor
+     * unconditionally and dispatched every declared action, including on a verdict
+     * of `allow`.
+     */
+    readonly blocking?: boolean;
     readonly onActionComplete?: (result: ActionResult) => void;
 }
 export declare class ActionExecutor {
     private readonly adapter;
     private readonly dryRun;
+    private readonly blocking;
     private readonly onActionComplete?;
     constructor(config: ActionExecutorConfig);
     /**
@@ -40,5 +81,7 @@ export declare class ActionExecutor {
     getAdapterName(): string;
     /** Check if dry-run mode is enabled */
     isDryRun(): boolean;
+    /** Is this executor permitted to dispatch enforcement actions? */
+    isBlocking(): boolean;
 }
 //# sourceMappingURL=action-executor.d.ts.map

package/dist/action-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-executor.d.ts","sourceRoot":"","sources":["../src/action-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAgCpB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC5D;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAiC;gBAEvD,MAAM,EAAE,oBAAoB;IAMxC;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAgB1E;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;YACW,UAAU;IAmDxB,2CAA2C;IAC3C,cAAc,IAAI,MAAM;IAIxB,uCAAuC;IACvC,QAAQ,IAAI,OAAO;CAGpB"}
+{"version":3,"file":"action-executor.d.ts","sourceRoot":"","sources":["../src/action-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAC;AAmBpB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,eAAe,CAAC,CAYhF,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC5D;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAiC;gBAEvD,MAAM,EAAE,oBAAoB;IAOxC;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAgB1E;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;OAEG;YACW,UAAU;IAmExB,2CAA2C;IAC3C,cAAc,IAAI,MAAM;IAIxB,uCAAuC;IACvC,QAAQ,IAAI,OAAO;IAInB,kEAAkE;IAClE,UAAU,IAAI,OAAO;CAGtB"}

package/dist/action-executor.js

@@ -5,8 +5,17 @@
  * to a PlatformAdapter. Handles per-action errors so one failure
  * does not block the rest.
  *
+ * ENFORCEMENT GATE: actions above the OBSERVE blast-radius tier are dispatched
+ * only when the operator has enabled blocking (`blocking: true` here; the CLI
+ * maps ATR_BLOCKING / `atr guard --blocking` onto it). Without it they are
+ * recorded as suppressed and the adapter is never called. See
+ * src/enforcement.ts for why this is opt-in and
+ * src/quality/action-eligibility.ts for the tier ladder this gate reads.
+ *
  * @module agent-threat-rules/action-executor
  */
+import { isEnforcementAction, blockingFromConfig } from "./enforcement.js";
+import { TIER_NAMES, actionTier } from "./quality/action-eligibility.js";
 /** Priority order: lower number = higher priority (executed first) */
 const ACTION_PRIORITY = {
     kill_agent: 0,
@@ -21,8 +30,18 @@ const ACTION_PRIORITY = {
     snapshot: 9,
     shadow: 10,
 };
-/** Map action names to PlatformAdapter method names */
-const ACTION_METHOD_MAP = {
+/**
+ * Map action names to PlatformAdapter method names.
+ *
+ * Exported because it is the authoritative list of actions this engine can
+ * actually dispatch. Rule files also carry SPEC Appendix A vocabulary
+ * (`revoke_credential`, `quarantine_artifact`, ...) that has no entry here and
+ * therefore never reaches an adapter — see executeOne's "Unknown action" branch.
+ * src/quality/action-eligibility.ts ranks exactly these keys by blast radius, and
+ * tests/action-eligibility.test.ts pins the two sets equal, so implementing a new
+ * adapter method forces an explicit decision about how destructive it is.
+ */
+export const ACTION_METHOD_MAP = {
     block_input: "blockInput",
     block_output: "blockOutput",
     block_tool: "blockTool",
@@ -38,10 +57,12 @@ const ACTION_METHOD_MAP = {
 export class ActionExecutor {
     adapter;
     dryRun;
+    blocking;
     onActionComplete;
     constructor(config) {
         this.adapter = config.adapter;
         this.dryRun = config.dryRun ?? false;
+        this.blocking = blockingFromConfig(config.blocking);
         this.onActionComplete = config.onActionComplete;
     }
     /**
@@ -81,6 +102,20 @@ export class ActionExecutor {
      */
     async executeOne(action, context) {
         const timestamp = new Date().toISOString();
+        // Enforcement gate — checked BEFORE dry-run, because "would execute" is
+        // false for an action that enforcement policy forbids. The adapter is never
+        // reached, so a downstream adapter that really blocks cannot act while the
+        // hook channel is telling the host nothing.
+        if (!this.blocking && isEnforcementAction(action)) {
+            return Object.freeze({
+                action,
+                success: true,
+                message: `[advisory] Suppressed ${action} (tier ${TIER_NAMES[actionTier(action)]}): ` +
+                    `blocking is disabled. Enable it with blocking: true (atr guard: ` +
+                    `--blocking or ATR_BLOCKING=1).`,
+                timestamp,
+            });
+        }
         if (this.dryRun) {
             return Object.freeze({
                 action,
@@ -128,5 +163,9 @@ export class ActionExecutor {
     isDryRun() {
         return this.dryRun;
     }
+    /** Is this executor permitted to dispatch enforcement actions? */
+    isBlocking() {
+        return this.blocking;
+    }
 }
 //# sourceMappingURL=action-executor.js.map

package/dist/action-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-executor.js","sourceRoot":"","sources":["../src/action-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,sEAAsE;AACtE,MAAM,eAAe,GAAwC;IAC3D,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;IACb,kBAAkB,EAAE,CAAC;IACrB,kBAAkB,EAAE,CAAC;IACrB,aAAa,EAAE,CAAC;IAChB,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,uDAAuD;AACvD,MAAM,iBAAiB,GAAuD;IAC5E,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,aAAa;IAC3B,UAAU,EAAE,WAAW;IACvB,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,cAAc;IAC7B,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,mBAAmB;IACvC,UAAU,EAAE,WAAW;CACxB,CAAC;AAQF,MAAM,OAAO,cAAc;IACR,OAAO,CAAkB;IACzB,MAAM,CAAU;IAChB,gBAAgB,CAAkC;IAEnE,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,OAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC1B,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CACtB,MAAiB,EACjB,OAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,4BAA4B,MAAM,EAAE;gBAC7C,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM;oBACN,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,mBAAmB,MAAM,EAAE;oBACpC,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAEzB,CAAC;YAEd,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM;oBACN,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,yBAAyB,UAAU,EAAE;oBAC3E,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,WAAW,MAAM,aAAa,OAAO,EAAE;gBAChD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,uCAAuC;IACvC,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"action-executor.js","sourceRoot":"","sources":["../src/action-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEzE,sEAAsE;AACtE,MAAM,eAAe,GAAwC;IAC3D,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,CAAC;IACb,kBAAkB,EAAE,CAAC;IACrB,kBAAkB,EAAE,CAAC;IACrB,aAAa,EAAE,CAAC;IAChB,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,EAAE;CACX,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAuD;IACnF,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,aAAa;IAC3B,UAAU,EAAE,WAAW;IACvB,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,cAAc;IAC7B,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,mBAAmB;IACvC,UAAU,EAAE,WAAW;CACxB,CAAC;AA6BF,MAAM,OAAO,cAAc;IACR,OAAO,CAAkB;IACzB,MAAM,CAAU;IAChB,QAAQ,CAAU;IAClB,gBAAgB,CAAkC;IAEnE,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,OAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC1B,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CACtB,MAAiB,EACjB,OAAyB;QAEzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3C,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,OAAO,EACL,yBAAyB,MAAM,UAAU,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK;oBAC5E,kEAAkE;oBAClE,gCAAgC;gBAClC,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM;gBACN,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,4BAA4B,MAAM,EAAE;gBAC7C,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM;oBACN,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,mBAAmB,MAAM,EAAE;oBACpC,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAEzB,CAAC;YAEd,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,MAAM;oBACN,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,yBAAyB,UAAU,EAAE;oBAC3E,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,MAAM;gBACN,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,WAAW,MAAM,aAAa,OAAO,EAAE;gBAChD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,uCAAuC;IACvC,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,kEAAkE;IAClE,UAAU;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF"}

package/dist/cli/scan-handler.d.ts

@@ -5,6 +5,7 @@
  * @module agent-threat-rules/cli/scan-handler
  */
 import type { ScanType } from '../types.js';
+import type { Lane } from '../quality/rule-contract.js';
 export interface ScanOptions {
     readonly rules?: string;
     readonly json?: boolean;
@@ -20,6 +21,14 @@ export interface ScanOptions {
     readonly semanticModel?: string;
     readonly semanticTimeout?: string;
     readonly semanticNoJsonMode?: boolean;
+    /**
+     * Detection lane (which rule maturities may fire). Undefined means the
+     * engine's built-in default; `src/cli.ts` resolves `--lane` and `ATR_LANE`
+     * and always passes an explicit value, because the engine itself no longer
+     * reads the environment. Scanning never blocks anything, so the blocking
+     * opt-in has no meaning here; only the lane does.
+     */
+    readonly lane?: Lane;
 }
 /** Detect whether the target is an MCP event JSON or SKILL.md file/directory. */
 export declare function detectInputType(targetPath: string): ScanType;

package/dist/cli/scan-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-handler.d.ts","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsB9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CA0B5D;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAoDf"}
+{"version":3,"file":"scan-handler.d.ts","sourceRoot":"","sources":["../../src/cli/scan-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAoC,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AAsBxD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CA0B5D;AAED,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/cli/scan-handler.js

@@ -119,7 +119,12 @@ async function scanMcpEvents(eventsPath, rulesDir, options, reporter) {
         process.exit(1);
     }
     const semantic = createSemanticJudgeFromScanOptions(options);
-    const engine = new ATREngine({ rulesDir, reporter, semanticJudge: semantic.judge });
+    const engine = new ATREngine({
+        rulesDir,
+        reporter,
+        semanticJudge: semantic.judge,
+        ...(options.lane ? { lane: options.lane } : {}),
+    });
     await engine.loadRules();
     if (semantic.enabled && !options.json && !options.sarif) {
         console.error(`${DIM}Semantic judge: enabled for method=semantic rules${RESET}`);
@@ -195,7 +200,12 @@ async function scanSkillFiles(targetPath, rulesDir, options, reporter) {
         process.exit(1);
     }
     const semantic = createSemanticJudgeFromScanOptions(options);
-    const engine = new ATREngine({ rulesDir, reporter, semanticJudge: semantic.judge });
+    const engine = new ATREngine({
+        rulesDir,
+        reporter,
+        semanticJudge: semantic.judge,
+        ...(options.lane ? { lane: options.lane } : {}),
+    });
     await engine.loadRules();
     if (semantic.enabled && !options.json && !options.sarif) {
         console.error(`${DIM}Semantic judge: enabled for method=semantic rules${RESET}`);