diff-sentry 0.4.3__tar.gz → 0.5.0__tar.gz

diff_sentry-0.5.0/.claude/rules/detect-setup.md

@@ -0,0 +1,23 @@
+---
+paths:
+  - "diff_sentry/detect.py"
+  - "diff_sentry/config.py"
+  - "diff_sentry/cli.py"
+  - "diff_sentry/deep_classify.py"
+  - "diff_sentry/__init__.py"
+  - ".env.example"
+---
+
+# Model roles, auth, and run failures
+
+- **Failures name themselves.** With `max_retries=1` (set in `detect.setup`), a non-retryable LM error
+  (auth / billing / configuration / unsupported model) escapes after one attempt as the raw
+  `dspy.LMError` subclass. An `RLMTaskError` means the single attempt ended in an adapter parse failure,
+  an invalid result, or a retryable endpoint fault (timeout / 5xx / transport). `cli.run` turns both into
+  a `status=failed` response. Check the endpoint before suspecting the schema.
+- **Subscription auth is a lazy, opt-in branch.** A role whose model is `claude-agent-sdk/<id>` runs on
+  rlm-harness's `ClaudeAgentLM`, imported only inside `detect._maybe_subscription_lm` and never from
+  `__init__.py`, so `import diff_sentry` stays dspy-free and a proxy-only install never touches the SDK.
+- **The classifier never runs on the subscription.** It is a separate OpenAI-compatible client
+  (`deep_classify._selfclassify_chat`), so `config.from_env` rejects a `claude-agent-sdk/` classifier
+  model, whether set explicitly or inherited from `DS_SUB_LM`. Mixed auth across roles is by design.

diff_sentry-0.5.0/.claude/rules/handoff.md

@@ -0,0 +1,45 @@
+# Context preservation (read before auto-compacting)
+
+Durable knowledge belongs in tracked files; a handoff summary carries only the in-flight session state
+they do not hold yet.
+
+- **Stable invariants** → `AGENTS.md` **Hard invariants**, or the topic rule under `.claude/rules/`.
+- **Shipped changes** → the commit message, and a `CHANGELOG.md` entry at release.
+- **Open / proposed work** → the issue tracker, or `AGENTS.md` **Layout** (next increments).
+
+A handoff summary covers, in order:
+
+1. **Decisions agreed this session** that are not yet in those files, each with its reason. Promote
+   durable ones into `AGENTS.md` or a topic rule before they fade.
+2. **Files / symbols changed**, as `path:symbol — final shape` one-liners (e.g.
+   `assemble.py:assemble_verdict — signal = verdict∈emit_on OR severity≥floor`). No diffs, no
+   intermediate revisions.
+3. **Current status**: what passes (`uv run pytest`, the eval suite, `uvx ruff check .`) with counts,
+   what is broken, the last command and its result. One paragraph.
+4. **Open items** not yet tracked, each marked `proposed`, `accepted-not-done`, or `rejected`.
+5. **Seams touched**: `classify_backend` (`"self"` or a dedicated backend in progress), the host-side
+   pre-filter / live GitHub+SIEM wiring, and the rlm-harness pin. A resumed session must not re-open a
+   seam that moved.
+6. **The user's in-flight intent and acceptance criteria.**
+
+Do not preserve anything already in `AGENTS.md`, `README.md`, `.env.example`, or `pyproject.toml`; tool
+output, file listings, or file contents readable from disk; or exploration narration that led to no
+decision.
+
+Format (keep it under ~40 lines):
+
+```
+## Session state
+- Goal: <one sentence>
+- Status: <what passes, what doesn't, last command + result>
+- Seams: <only the ones touched, one line each>
+
+## Decisions
+- <decision> — <why>   (→ AGENTS.md / topic rule / commit message)
+
+## Changed
+- <path:symbol> — <what & why>
+
+## Open
+- [proposed|accepted-not-done|rejected] <item>
+```

diff_sentry-0.5.0/.claude/rules/indicators.md

@@ -0,0 +1,42 @@
+---
+paths:
+  - "diff_sentry/indicators.py"
+  - "diff_sentry/normalize.py"
+  - "tests/corpus/**"
+  - "tests/test_indicators.py"
+  - "tests/test_detection_quality.py"
+  - "tests/test_incident_*.py"
+---
+
+# Indicator rules
+
+- **Deterministic, pure Python, no subprocess.** A subprocess spawned inside the live dspy.RLM/asyncio
+  process hangs; any heavier scanner belongs host-side, after the run. `mint_id` is a sha1 over
+  rule+evidence (no time, no randomness), so a baseline hit and an in-loop re-scan of the same content
+  dedupe to ONE union member. Hit evidence is a bounded snippet (`_MAX_EVIDENCE`), never the whole diff.
+- **Severities are tuned, not monotone-paranoid.** A plain workflow-file edit is `medium`, below the
+  signal floor on purpose: a benign workflow PR must not force a SIEM signal, and a real payload inside
+  the workflow fires the high/critical shell/obfuscation rules itself. A CODEOWNERS reassignment is
+  `high`. A bare `pull_request_target` (the ordinary label-bot shape) is `medium`; the same trigger
+  checking out the PR head is `pwn-request` / `critical` (untrusted code with the base repo's secrets).
+  `dev-tunnel-endpoint`, `content-addressed-host` (IPFS) and `dynamic-code-eval` are sub-floor
+  corroborators; pairs with no innocent reading (`child_process` + `detached`, network-fetch +
+  file-write) are `high`. Requiring both halves is how a common primitive becomes evidence without
+  becoming noise.
+- **Every rule ships with its negative case**, and `tests/corpus/` pins the suite's hit/miss behavior.
+- **`pwn-request` has three checkout forms, each requiring the privileged trigger:** the head expression
+  on a `ref:` (directly or one binding hop away), a hand-rolled `git fetch` / `gh pr checkout`, and
+  `allow-unsafe-pr-checkout: true` (the actions/checkout v5.1+ opt-in to the fork-PR checkout it blocks
+  by default; the line states the intent, so no dataflow is needed). Each form has its own title: calling
+  an opt-in "checks out the PR HEAD" sends a reader hunting for a `ref:` that is not there.
+- **A paired rule only pairs within one file.** `scan_diff` splits a unified diff on its file headers;
+  `scan_content` does the same for an event, whose files `raw_content` would otherwise join into one
+  header-less blob. `scan` and the in-loop tool use `scan_diff`, the host-side baseline uses
+  `scan_content`, and `normalize.content_segments` is the single definition both `raw_content` and the
+  baseline build on. Per-file scoping stops two halves from different files composing into a `critical`
+  no file contains, and keeps a hit id byte-stable between a whole-diff and a single-file scan, which is
+  what lets the baseline and an in-loop scan dedupe (MF3). Non-diff input falls through to a whole-text
+  scan; keep that fallback.
+- **The in-loop tool registers as exactly `scan_indicators`.** dspy registers a tool under its
+  `__name__` and the prompt calls `scan_indicators(region)`; any other name makes every sandbox call a
+  NameError. The inner callable is renamed on purpose (`make_indicator_tool`); keep it.

diff_sentry-0.5.0/.claude/rules/rubric-and-eval.md

@@ -0,0 +1,42 @@
+---
+paths:
+  - "diff_sentry/rubric.py"
+  - "diff_sentry/rl_export.py"
+  - "diff_sentry/response.py"
+  - "diff_sentry/assemble.py"
+  - "eval/**"
+  - "studio/**"
+---
+
+# ATLAS rubric labels and the eval member
+
+## The rubric is a reward-free label surface
+
+- `rl_export.rubric_signal` attaches the ATLAS 4-category (TF/TA/TG/PA) decomposition as LABELS: a fixed,
+  no-LLM skeleton in `run_start` meta (`rubric_to_meta(default_rubric())`, one criterion per category,
+  since the task is constant; there is no `generate_rubric` path) plus deterministic per-criterion
+  `criteria_facts`.
+- The facts are a re-lens over `run_labels` / `run_metrics`, not a second derivation: `rubric.trace_facts`
+  reuses them, so a criterion's `observed` cannot drift from what a trainer reads. `_CATEGORY_LENS` maps
+  TF↔(verdict / signal / hit_iteration_cap), TA↔(scan / deep_classify / analyst / fetch / skill counts +
+  circuit-breaks + analyst failures), TG↔(indicator_count / max_indicator_severity / signal /
+  cited_unknown), PA↔(verdict / cited_unknown).
+- `CriterionFact` has no score/met field; the trainer scores. Never add a reward/score/met field to any
+  rubric type.
+- `rubric.py` is a dspy-free leaf: it imports only `.schema` at top, and its `rl_export` reuse is a
+  function-level import (that path is dspy-free too), so `response.py` can import it at top.
+- `response._rubric` surfaces it as `DetectionResponse.rubric` (`RubricReport`); the studio shows it as a
+  "labels — not a score" card that adds no judgement. Keep the card legacy-guarded: a response without a
+  `rubric` renders nothing.
+
+## The eval member measures; it never rewards
+
+- `eval/` (`diff-sentry-eval`) scores a recorded run's assembled verdict with a fixed external ATLAS
+  LLM-as-judge: TF/TA/TG/PA on 0–10, TF primary, per-category means only, no composite, no threshold.
+- It is a one-way reader: it reaches diff-sentry only through `verdict_from_events` / `run_labels` /
+  `run_metrics` / `AssembledVerdict`, and `diff_sentry` never imports `diff_sentry_eval`
+  (`eval/tests/test_boundary.py` enforces it).
+- The judge is rubric-free (it never reads `rubric_signal`, which would bias the measure) and holds
+  read-never-execute: it assesses the classification statically and treats the change as untrusted.
+- A run it cannot score (never finalized, no usable verdict, judge failed) is `unscored`, never a fake 0.
+  See `eval/README.md`.

diff_sentry-0.5.0/.claude/skills/release/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: release
+description: Cut a diff-sentry release — bump the five version sites together, write the CHANGELOG entry, and publish the GitHub Release that ships PyPI + the Marketplace Action. Use when asked to release, bump the version, or tag vX.Y.Z.
+---
+
+# Cut a diff-sentry release
+
+A release moves FIVE version sites together, plus a `CHANGELOG.md` entry:
+
+1. `pyproject.toml` `[project].version`
+2. `diff_sentry/__init__.py` `__version__`
+3. `action.yml` `inputs.version.default` (decides which PyPI release a consumer's `uses: …@vX.Y.Z` installs)
+4. `README.md` quickstart `uses: qazbnm456/diff-sentry@vX.Y.Z`
+5. `uv.lock`, via `uv lock`
+
+`release.yml` fails the build unless the tag, the built wheel's version, the installed `__version__`, and
+the `action.yml` default all agree, and it checks that the installed console script flags a known-malicious
+diff. Nothing gates the README `uses:` line: a stale one sends new adopters to the previous release, so
+check it by hand.
+
+## Steps
+
+1. Freeze the boundary: `git log v<last>..HEAD`. Every `feat:` / `fix:` / `deps:` commit inside it is a
+   CHANGELOG candidate.
+2. Write the `CHANGELOG.md` entry in the file's existing style: one sentence per user-visible outcome,
+   breaking changes and required actions explicit, no debugging story.
+3. Bump sites 1–4, run `uv lock`, then verify: `uv run pytest`, the eval suite
+   (`uv run --package diff-sentry-eval --extra dev python -m pytest eval/tests`), `uvx ruff check .`.
+4. Commit (`chore: release X.Y.Z`) and push to `main` once the user approves.
+5. Publishing a GitHub Release tagged `vX.Y.Z` (with "Publish this Action to the GitHub Marketplace"
+   ticked) is what builds, verifies, and uploads to PyPI via Trusted Publishing. The upload is
+   irreversible; confirm with the user before publishing.

diff_sentry-0.5.0/.env.example

@@ -0,0 +1,55 @@
+# diff-sentry: model roles and runtime knobs. Copy to .env; a live run needs these plus a Deno sandbox.
+
+# --- Model roles (required for a live `pr`/`issue`/`classify` run) ---
+# planner: a cheap, injection-resistant orchestrator that holds the diff in the REPL and triages.
+DS_ROOT_LM=your-planner-model
+# analyst: an expensive model reached via llm_query for a subtle source->sink (short questions only).
+DS_SUB_LM=your-analyst-model
+# One OpenAI-compatible proxy serves all roles. When DS_BASE_URL is set the model names are the plain
+# ids your endpoint serves (e.g. qwen/qwen3-next), not litellm-prefixed.
+DS_BASE_URL=https://your-openai-compatible-endpoint/v1
+DS_API_KEY=sk-...
+
+# --- OR: run planner + analyst on a Claude Pro/Max subscription (no API key) ---
+# A role with the `claude-agent-sdk/<id>` prefix runs on your Claude subscription through the Claude
+# Agent SDK (`rlm_harness.ClaudeAgentLM`, the `subscription` extra). Each call is a pure completion:
+# no tools, no filesystem, no settings leakage. Prerequisites:
+#   - `uv sync --extra subscription`
+#   - the Claude Code CLI installed and logged in (`claude` then /login, or `claude setup-token` and
+#     export CLAUDE_CODE_OAUTH_TOKEN)
+#   - `unset ANTHROPIC_API_KEY`: the CLI prefers it over the subscription and would bill API credit,
+#     so the adapter refuses to start while it is set
+# Prefer full model ids over aliases, which drift.
+#   DS_ROOT_LM=claude-agent-sdk/claude-sonnet-5     # planner on Sonnet 5
+#   DS_SUB_LM=claude-agent-sdk/claude-fable-5       # analyst on Fable 5
+# DS_BASE_URL/DS_API_KEY then serve only the classifier, which always needs an OpenAI-compatible
+# endpoint (a subscription-only run is not supported). Set DS_CLASSIFIER_LM to a real model id (plus
+# DS_CLASSIFIER_BASE_URL/DS_CLASSIFIER_API_KEY if it is a separate box). Left unset, it inherits the
+# `claude-agent-sdk/…` DS_SUB_LM and config loading fails with an actionable error.
+# Budgets use the same env vars as proxy mode. Each call adds ~2-5s of CLI-spawn overhead, so keep
+# these runs interactive, not batch. DS_PLANNER_MAX_TOKENS has no effect here: the Agent SDK exposes
+# no token or sampling controls.
+
+# --- Second-stage classifier (the swappable seam) ---
+# Defaults to the analyst model on DS_BASE_URL/DS_API_KEY. Required when the analyst runs on the
+# subscription (see above).
+# DS_CLASSIFIER_LM=your-strong-classifier
+# DS_CLASSIFIER_BASE_URL=https://your-classifier-endpoint/v1
+# DS_CLASSIFIER_API_KEY=sk-...
+# DS_CLASSIFIER_CIRCUIT_BREAK=4
+
+# --- RLM runtime ---
+# DS_INTERPRETER=pyodide       # read-not-execute: the sandbox never runs the change. `deno` is an alias.
+# DS_MAX_ITERATIONS=25
+# DS_MAX_LLM_CALLS=8           # caps only analyst (llm_query) escalations
+# DS_ADAPTER=json              # portable structured output (OpenAI + vLLM/NIM)
+# DS_PLANNER_MAX_TOKENS=16384  # generous, so a reasoning planner isn't truncated to empty content
+
+# --- Enrichment fetch (off by default: an exfil surface on attacker-authored input; GitHub-allowlisted) ---
+# DS_ENABLE_FETCH=false
+# DS_FETCH_ALLOW_CIDRS=198.18.0.0/16   # only if behind a fake-IP proxy / split-DNS VPN
+
+# --- Host-side SIEM emitter (opt-in; deterministic POST after the run) ---
+# DS_SIEM_WEBHOOK_URL=https://your-siem/intake
+# DS_SIEM_TOKEN=...
+# DS_EMIT_ON=suspicious,malicious

{diff_sentry-0.4.3 → diff_sentry-0.5.0}/.github/workflows/ci.yml

@@ -2,8 +2,8 @@ name: CI
 
 # Offline suite only: no live LLM, no network calls in tests, no Deno sandbox — dspy-bearing paths use
 # DummyLM / rlm-harness's ScriptedInterpreter, transports are injected fakes, and the corpus pins the
-# indicator suite's hit/miss behavior (see CLAUDE.md "Verify"). `uv sync` pulls rlm-harness from GitHub
-# (uv.lock pins the exact commit).
+# indicator suite's hit/miss behavior (see AGENTS.md "Verify"). `uv sync` resolves rlm-harness from PyPI
+# at the exact version pinned in pyproject.toml / uv.lock.
 on:
   push:
     branches: [main]
@@ -39,7 +39,7 @@ jobs:
         with:
           enable-cache: true
 
-      # --all-packages brings in the studio workspace member, --all-extras every optional surface
+      # --all-packages brings in the studio and eval workspace members, --all-extras every optional surface
       # (classify/observe/subscription + the studio dev extra) so both suites resolve in one env.
       - name: Sync (core + studio workspace)
         run: uv sync --all-extras --all-packages --python ${{ matrix.python-version }}
@@ -50,8 +50,8 @@ jobs:
       - name: Studio console tests
         run: uv run --python ${{ matrix.python-version }} python -m pytest studio/tests
 
-      # The eval workspace member (diff-sentry-eval) — its OWN offline suite: the reward-free ATLAS
-      # scorecard, stub judge, synthetic traces, no creds. `--all-packages` above already installed it.
+      # The eval workspace member (diff-sentry-eval) has its OWN offline suite: the reward-free ATLAS
+      # scorecard, stub judge, synthetic traces, no creds.
       - name: Eval scorecard tests
         run: uv run --package diff-sentry-eval --python ${{ matrix.python-version }} python -m pytest eval/tests
 
@@ -89,7 +89,7 @@ jobs:
           # tabulate all of the above. Scanning those against our own rules is a guaranteed self-hit
           # (the pipe-to-shell example inside detect.INSTRUCTIONS and the field-separator token quoted
           # in README's rule table both fire), so they are reported without gating while the machinery
-          # and the build/CI/dependency surface stay enforced. Note this file is in the GATED half:
+          # and the build/CI/dependency surface stay enforced. This file is in the GATED half:
           # describe a payload shape here, never quote one.
           report-only-paths: |
             diff_sentry/indicators.py
@@ -121,9 +121,14 @@ jobs:
           ver=$(uv run --no-project --with pyyaml python -c \
                 "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
           echo "action.yml default version: $ver"
-          # The fixture lives under tests/ (a report-only path) rather than inline here. This file is in
-          # the GATED half, so a payload written into it fails our own scan -- which is exactly what
-          # happened to the first version of this job. Payload samples belong where payloads are allowed.
+          # The fixture lives under tests/ (a report-only path) rather than inline here: this file is in
+          # the GATED half, so a payload written into it fails our own scan.
+          # FIRST prove the install. `scan` exits 1 when it flags, and uvx ALSO exits 1 when it cannot
+          # resolve `diff-sentry==${ver}` -- so the negative check below cannot tell "flagged" from "never
+          # installed" (e.g. a release commit whose version is not on PyPI yet).
+          got=$(uvx "diff-sentry==${ver}" --version)
+          echo "installed: $got"
+          case "$got" in *" ${ver}") ;; *) echo "::error::expected version ${ver}, got '$got'"; exit 1;; esac
           # Must exit non-zero: a package that installs but scans nothing would otherwise pass silently.
           if uvx "diff-sentry==${ver}" scan tests/fixtures/known-malicious.diff; then
             echo "::error::the published package did not flag a known-malicious diff"
@@ -141,8 +146,7 @@ jobs:
           enable-cache: true
       - name: Lint
         # PINNED on purpose. `uvx ruff` resolves the latest release at run time, and ruff's DEFAULT
-        # rule set is not a stable contract — 0.16 expanded it far past the pycodestyle/pyflakes
-        # baseline, which would have turned this job red on the next push with no code change. Bump
-        # it deliberately, with the resulting fixes in the same commit, rather than letting a
-        # release do it for you.
+        # rule set is not a stable contract (0.16 widened it well past the pycodestyle/pyflakes
+        # baseline), so an unpinned run can turn this job red with no code change. Bump it
+        # deliberately, with the resulting fixes in the same commit.
         run: uvx ruff@0.16.0 check .

{diff_sentry-0.4.3 → diff_sentry-0.5.0}/.github/workflows/release.yml

@@ -34,11 +34,10 @@ jobs:
       - name: Build sdist + wheel
         run: uv build
 
-      # Verify the ARTIFACT, not the checkout — a wheel can build cleanly and still be unusable. This
-      # project shipped for months with no `[project.scripts]` entry point at all, so `uvx diff-sentry`
-      # (the exact command the GitHub Action runs) could not have worked; nothing in the source tree
-      # would have told you. Installing the built wheel into a clean environment and running it is what
-      # catches that.
+      # Verify the ARTIFACT, not the checkout — a wheel can build cleanly and still be unusable. Without
+      # a `[project.scripts]` entry point, for example, `uvx diff-sentry` (the exact command the GitHub
+      # Action runs) cannot work, and nothing in the source tree says so. Installing the built wheel into
+      # a clean environment and running it is what catches that.
       #
       # It also settles the version question against the thing being uploaded rather than against a
       # regex over the source. Three identities have to agree: the git tag people pin, the version

{diff_sentry-0.4.3 → diff_sentry-0.5.0}/.gitignore

@@ -23,6 +23,6 @@ output/
 # Claude Code local overrides (never commit)
 .claude/settings.local.json
 
-# Build artifacts. `uv build` is now a normal local step (release.yml runs it), so an
+# Build artifacts. `uv build` is a normal local step (release.yml runs it), so an
 # accidental `git add .` must not sweep a wheel into the repo.
 dist/

diff_sentry-0.5.0/AGENTS.md

@@ -0,0 +1,126 @@
+# diff-sentry — agent guide
+
+A BewAIre-style malicious-change detector built on `rlm-harness`. It classifies ONE GitHub change
+(PR / issue / push) for malicious intent: the change is UNTRUSTED DATA held in a sandboxed REPL, the
+planner SUBMITs a judgement-only verdict, and the deterministic indicator EVIDENCE is unioned on read into
+a SIEM signal. `README.md` has the pipeline table and the honest caveats; rlm-harness's "Building a
+consumer" is the extension contract this project lives within.
+
+rlm-harness is an exact PyPI pin (`rlm-harness==X.Y.Z` in `pyproject.toml`, locked in `uv.lock`). Overlay
+`uv pip install -e ../rlm-harness` only while co-developing the kit, and bump the pin once the fix ships.
+
+## Verify
+
+- `uv run pytest` — the full offline suite (`uv sync --group dev` first). No live LLM, network, or Deno:
+  dspy paths use DummyLM / rlm-harness's `ScriptedInterpreter`, transports are injected fakes, and
+  `tests/corpus/` pins the indicator suite's hit/miss behavior.
+- `uv run --package diff-sentry-eval --extra dev python -m pytest eval/tests` — the eval member's own suite
+  (the `--package` is required; a root `uv run` does not install the member). Run it when you touch
+  `assemble.py`, `rl_export.py`, `rubric.py`, `schema.py`, or the trace payloads it scores.
+- `uvx ruff check .` — lint (line-length 110). CI runs it as its own job, next to both suites and the
+  node tests (`.github/workflows/ci.yml`).
+- A live run needs role creds (`DS_*`, see `.env.example`), Deno (`brew install deno`), and `gh` for
+  `pr`/`issue` ingest. `render`/`export` are offline; `classify` ingests offline but classifies live.
+
+## Running — always through the CLI
+
+- Run via `cli` (`pr` / `issue` / `classify`), never an ad-hoc script. `cli.run(event, …)` is the
+  programmatic entry: it records `<out>/traces/{run_id}.jsonl` (dropping a stale one first, since
+  TraceRecorder appends), writes `<out>/responses/{run_id}.json`, and emits the SIEM signal host-side
+  after the run. It never raises: a crash still writes a `status=failed` response that can signal off the
+  evidence floor. Extend `cli.py` rather than driving `detect_from_event` / `build_response` directly.
+- Offline: `python -m diff_sentry render <trace> <run_id>` re-renders a response;
+  `python -m diff_sentry export "output/traces/*.jsonl" ds.json` exports the reward-free dataset.
+
+## Hard invariants — do not break
+
+- **The change is DATA: read, never execute.** It is a REPL variable under the default `pyodide`
+  interpreter; nothing in it is run, built, or fetched-and-run. An embedded instruction is a
+  `prompt-injection` signal, never a command. Never route the interpreter to `local`.
+- **Judgement-only SUBMIT; evidence is unioned on read (MF3).** `ChangeVerdict` has no hits field; the
+  planner may only CITE ids (`indicator_ids`). `assemble.assemble_verdict` unions every hit in the trace
+  (run_start `baseline_indicators` ∪ each `scan_indicators` tool_call) and derives
+  `signal = verdict ∈ emit_on OR max severity ≥ SIGNAL_SEVERITY_FLOOR`. A false-benign verdict cannot
+  suppress evidence; a cited id with no recorded hit lands in `cited_unknown_ids`. The same assembly runs
+  on every read path (live, re-render, `rl_export`). Never add a hits/severity/signal field to the SUBMIT
+  type or a second signal derivation.
+- **An ungroundable input yields `inconclusive`, never a confident verdict.** `inconclusive` is a
+  sanctioned 4th SUBMIT value (`schema.INCONCLUSIVE_VERDICT`) mapped to `status="inconclusive"` +
+  `RefusalInfo(reason="insufficient_evidence")`. The host-side backstop `normalize.has_groundable_content`
+  downgrades even a confident verdict when no groundable content exists. It is a reward-free negative
+  outcome, not an escape hatch for a hard-but-real change, and not in `emit_on`, so hard indicator
+  evidence still signals on its own.
+- **MF1: the metadata sandwich in `normalize_event`.** dspy previews ~1000 chars of head+tail, so an
+  identical derived-metadata header and footer deny the attacker those edges, and attacker-authored
+  metadata fields are capped (`_MAX_META_*`). The title/author ride in `raw_content` so the host-side
+  baseline catches a title-borne injection that skews the planner. Don't flatten the sandwich or lift
+  the caps.
+- **MF2: enrichment fetch is GitHub-allowlisted and off by default** (`enable_fetch=False`). An injected
+  instruction could steer a fetcher to `https://attacker.tld/?leak=…`: the kit's SSRF guard blocks
+  internal targets, and the `github_hosts` allowlist blocks external ones, re-checked on every redirect
+  hop. Never add a general-purpose fetch or fetch a URL the change names. `fetch_allow_cidrs` only
+  relaxes the resolved-IP layer (fake-IP proxy / split DNS); the syntactic guard still refuses
+  localhost/metadata.
+- **Indicators are deterministic, pure Python, and in-loop safe.** Rule-level invariants (severity
+  tuning, per-file pairing, `pwn-request`, the tool name) live in `.claude/rules/indicators.md`.
+- **Models are ROLES configured by env**: `DS_ROOT_LM` planner, `DS_SUB_LM` analyst, `DS_CLASSIFIER_LM`
+  classifier (defaults to the analyst). Refer to them by role; no hardcoded model name.
+- **The budget is hard: `max_retries=1`, no whole-RLM retry.** One change = one trajectory, so the trace
+  stays valid training data. A failed run is infra before it is a schema bug; see
+  `.claude/rules/detect-setup.md` for how the failure names itself.
+- **A second model-judgement is a TOOL, never the sub-LM.** `deep_classify` (on rlm-harness's
+  `make_model_tool`) is the swappable second-stage seam the planner chooses to call, so the decision is a
+  `tool_call` in the trajectory. The analyst intercept (`intercept_sub_lm`) is tracing-only, zero
+  transforms. Swapping the backend touches only `classify_backend` / `_selfclassify_chat`. The planner
+  passes distilled findings, never the whole diff.
+- **GitHub ingest and SIEM emission are host-side plumbing, never planner tools.** `ingest.py` shells out
+  to `gh` host-side (transport injectable); `emit.emit_signal` POSTs after the run, stays out of the
+  trajectory, and never raises. Only choices the policy makes are tools; delivering a finished result is
+  plumbing.
+- **This is a ROLLOUT source: trajectories, not reward.** `rl_export` passes `reward=None`; labels read
+  the assembled verdict and metrics are objective effort counters. `deep_classify` tool_calls train the
+  classifier; every other action is the planner's. A metric keeps ONE meaning across rlm-harness
+  versions (the corpus mixes them; `run_start.payload.rlm_harness` names the writer): a quantity a newer
+  kit makes observable gets a NEW key that is None where the trace cannot say (e.g. `analyst_failures`).
+  The ATLAS rubric and the eval member stay reward-free too; see `.claude/rules/rubric-and-eval.md`.
+- **Attack knowledge lives in `diff_sentry/skills/`, not the prompt.** The skill catalog is injected
+  (`load_skills_as_tools(discovery="inject")`) and `read_skill(name)` pulls a body on demand. Fix a wrong
+  convention by editing or adding a skill; `detect.INSTRUCTIONS` holds only identity, the MISSION frame,
+  the tool cost model, the triage loop, and output-gating rules. Skills ship via
+  `packages = ["diff_sentry"]`; a force-include duplicates them and breaks the build.
+- **Keep the dspy-free modules dspy-free.** `config`, `schema`, `normalize`, `indicators`, `assemble`,
+  `response`, `emit`, `ingest`, `rl_export`, and `rubric` must not import dspy at module top, and
+  `import diff_sentry` must not import dspy (`ClassifyChange` / `setup` / `run` / `detect_from_event` are
+  lazy PEP 562 re-exports).
+- **The trace self-describes the run.** `run_start` meta carries the normalized event, instructions,
+  source echo, `baseline_indicators`, `emit_on`, role→model names, budgets, and the rubric skeleton, so
+  an offline re-render/export re-derives the same `signal` (reading `emit_on` from meta, never current
+  config). Any new per-run config that affects read-time derivation must ride in meta.
+
+## Topic guides
+
+Claude Code loads each rule automatically when you touch a matching file; other agents should read the
+file before working in that area.
+
+| Area | File |
+|---|---|
+| Indicator rules, severities, corpus | `.claude/rules/indicators.md` |
+| Model roles, subscription auth, run failures | `.claude/rules/detect-setup.md` |
+| ATLAS rubric labels, eval member, studio rubric card | `.claude/rules/rubric-and-eval.md` |
+| Cutting a release (five version sites) | `.claude/skills/release/SKILL.md` |
+| What to keep across context compaction | `.claude/rules/handoff.md` |
+
+## Layout
+
+- rlm-harness owns the generic cores: `make_model_tool` (chat → retry → validate → circuit-break) under
+  `deep_classify`, and the SSRF primitives (`is_safe_url`, `resolved_host_is_safe`, `parse_cidrs`) under
+  `fetch_tool`, which adds the GitHub allowlist, the httpx provider, and tracing.
+- When this consumer needs a workaround, fix the reusable gap in rlm-harness generically; never
+  special-case diff-sentry there. Consumer values (`DS_*` roles, the verdict schema, indicator rules, the
+  SIEM payload shape) stay here.
+- Next increments: a cheap pre-filter tier (deterministic indicators + one small single-shot call) as
+  host-side plumbing in front of `cli.run`, not extra RLM turns; and live GitHub/SIEM wiring.
+- Two workspace members, never in the `diff_sentry` wheel: `studio/` (`diff-sentry-studio`, the detection
+  console, behind its `live` extra) and `eval/` (`diff-sentry-eval`, the reward-free scorecard). Both read
+  the trace / `DetectionResponse` contract through the public surface only. Keep the root wheel at
+  `packages = ["diff_sentry"]` so `uv build` never sweeps them in.

diff_sentry-0.5.0/CHANGELOG.md

@@ -0,0 +1,171 @@
+# Changelog
+
+All notable changes to diff-sentry, a BewAIre-style detector that classifies one GitHub change
+(PR, issue or push) for malicious intent on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness).
+
+## 0.5.0
+
+Upgrade from 0.4.3: dspy 3.4.0 removed the interface rlm-harness 1.10.1 hands its sandbox through, so a
+fresh 0.4.3 install resolves dspy 3.4.0 and every `pr` / `issue` / `classify` run fails with a
+`TypeError`. The Action's deterministic `scan` is unaffected. 0.5.0 pins `rlm-harness==1.14.0`, which
+caps dspy below 3.5.
+
+### Changed
+- **`rlm-harness==1.14.0`, which requires `dspy>=3.4.0,<3.5.0` and `pydantic>=2.11.0`** (from 1.10.1,
+  dspy 3.3.1). diff-sentry's own `pydantic` floor rises to match.
+- **Each exported action's `state` lists its prior actions in causal order** (interleaved by time)
+  instead of write order; labels, rubric facts and the SIEM signal are unchanged.
+- **A failed analyst escalation is recorded**: the trace gains a `sub_call` carrying the provider's
+  error and `cause: "endpoint"`. The new `analyst_failures` metric counts them (None for a trace
+  written before rlm-harness 1.13.0, which could not record them), and `analyst_calls` keeps counting
+  only escalations that got a response, so it means the same on traces from either side of the upgrade.
+- **The agent guide is `AGENTS.md` (formerly `CLAUDE.md`)**, which Claude Code 2.1.277+ and other coding
+  agents read natively. Area-specific invariants moved to path-scoped `.claude/rules/`, and the release
+  procedure to `.claude/skills/release`.
+
+### Added
+- **The studio's run telemetry flags refused analyst escalations**: the analyst tile turns amber and an
+  "N analyst escalations refused" chip appears; a trace too old to record refusals shows neither.
+
+### Fixed
+- **The studio feed shows a refused analyst escalation as "Ask analyst failed"** with the provider's
+  error, instead of rendering it like one that answered.
+- **The studio replays a run in causal order**: a turn's reasoning streams before the tool calls it
+  made, and `run_end` always streams last, even when a timestamp is missing, NaN or infinite.
+- **CI's consumer-install job fails when the published version cannot be installed**, instead of
+  passing green because the negative scan check also exits 1.
+
+### Docs
+- **Docs, comments and test docstrings state current facts only**, and claims that had drifted from the
+  code are corrected (studio replay order, `RefusalInfo` reasons, where CI resolves rlm-harness).
+
+## 0.4.3
+
+Dependencies only: the `diff_sentry` package itself is unchanged.
+
+### Changed
+- **`rlm-harness==1.10.1` and `dspy` 3.3.1** (from 1.0.0 and 3.2.1); the pin stays exact, and a fresh
+  install resolves fewer packages because dspy 3.3 drops several exact pins.
+- **Traces record more of each run** (the kit version in `run_start`; applied `budgets`, per-attempt
+  `usage` and the failed run's `error_chain` in `run_end`; `duration_s` on every tool call and
+  `sub_call`), while labels, metrics, rubric facts and the SIEM signal are derived exactly as before.
+- **A non-retryable LM error (auth, billing, configuration, unsupported model) fails after one attempt
+  and the `status=failed` response names the dspy error class**, so a credential problem reads
+  differently from a model that kept producing invalid output (`RLMTaskError`).
+- **The studio's "took" label on a tool call shows the recorded `duration_s`**, falling back to the
+  event gap only for older traces.
+
+### Fixed
+- **An analyst escalation appears in the trace and the exported datasets exactly once.**
+- **The analyst intercept handles dspy 3.3's typed `LMResponse`.**
+- **A payload containing an unpaired surrogate is recorded** instead of being dropped from the trace.
+
+### Docs
+- **`CLAUDE.md` lists all five version sites a release moves**, noting that
+  `release.yml` does not gate the README's `uses:` line.
+
+## 0.4.2
+
+### Fixed
+- **Paired rules (`pwn-request`, `detached-process-spawn`) only pair signals from the same file**, in both
+  the in-loop `scan_indicators` tool and the host-side baseline, so two unrelated files can no longer
+  compose a `critical` that neither contains.
+
+### Changed
+- **`astral-sh/setup-uv` v10.0.1 and `actions/checkout` v7**, for the Node 24 runtime; the setup-uv bump
+  also applies inside `action.yml`, so repos running the action stop seeing the Node 20 deprecation
+  warning.
+
+### Added
+- **`pwn-request` flags `allow-unsafe-pr-checkout: true` under a privileged trigger** as its third
+  checkout form, with its own title; an explicit `false`, a removed opt-in, or a plain `pull_request`
+  trigger does not fire.
+- **Each hit names the file it came from** instead of the whole diff.
+- **A hit id is the same whether the diff was scanned whole or one file at a time**, so the baseline and
+  an in-loop re-scan de-duplicate to one piece of evidence.
+
+## 0.4.1
+
+### Changed
+- **`pypa/gh-action-pypi-publish` v1.14.2**, whose Twine 7 accepts the core metadata 2.5 that `uv build`
+  now emits.
+
+### Fixed
+- **`pwn-request` fires only when the PR-head expression reaches a checkout** (an `actions/checkout`
+  `ref:` or a `git checkout` / `git fetch` / `gh pr checkout` command), so the safe `workflow_run`
+  publisher shape the README recommends stays at the sub-floor `privileged-fork-trigger`.
+- **`pwn-request` follows one binding hop**, catching a head SHA bound to a name and then used as
+  `ref: ${{ env.HEAD }}`.
+- **A hand-rolled fetch of `refs/pull/${{ github.event.number }}/head` is detected.**
+
+## 0.4.0
+
+The first release, led by a GitHub Action anyone can install; the local model pipeline, studio and
+trajectory export remain for teams that run that infrastructure.
+
+### Added
+- **diff-sentry ships as a GitHub Action** (`action.yml`, with inputs `fail-on`, `report-only-paths`,
+  `base-sha`, `version` and outputs `failed`, `hit-count`, `max-severity`, `report`) that runs only the
+  deterministic scan, so it needs no credentials, network or Deno and runs safely on fork PRs under the
+  read-only token.
+- **A `scan` subcommand and a `diff-sentry` console entry point** run the deterministic scan standalone;
+  `--fail-on` defaults to the SIEM signal floor, with `--json` and `--include-deletions` options.
+- **Ten indicator rules for the Miasma attack families**: `pwn-request`, `privileged-fork-trigger`,
+  `diff-viewport-evasion`, `invisible-unicode`, `detached-process-spawn`, `inline-code-exec`,
+  `remote-fetch-to-disk`, `obfuscated-identifiers`, and the sub-floor corroborators `dynamic-code-eval`
+  and `content-addressed-host`, each with a negative case in the corpus.
+- **A `self-scan` CI job** runs this repo's own Action on every PR.
+- **`release.yml` publishes to PyPI through OIDC Trusted Publishing** after installing the built wheel
+  cleanly and checking that the tag, wheel filename and `__version__` agree.
+
+### Changed
+- **`rlm-kit` is replaced by `rlm-harness==1.0.0` from PyPI**; imports move to `rlm_harness`.
+- **The rubric uses `rlm_harness.rubric`**, and `schema` still re-exports `Criterion`, `CriterionFact`
+  and `RubricCriteria`.
+- **The README and package description lead with the Action.**
+- **A bare `uv sync` installs the `subscription-sdk` dev group**, keeping the Claude Agent SDK in the dev
+  environment.
+- **CI pins ruff to `0.16.0`.**
+
+### Fixed
+- **`scan` ignores lines a diff deletes by default**, so a commit that removes a payload is not flagged
+  for it.
+
+## 0.3.0
+
+### Added
+- **An input with no assessable content yields `inconclusive`** (`status="inconclusive"`,
+  `reason="insufficient_evidence"`) instead of a confident verdict, enforced by a host-side backstop and
+  exported as a reward-free `inconclusive` label; hard indicator evidence still forces a SIEM signal.
+- **The studio shows the short fields of an unrecognized tool call** in the drawer, the live feed and the
+  trajectory view instead of an empty step, and `deep_classify` keeps a child-rollout link when its
+  backend returns one.
+
+## 0.2.1
+
+### Fixed
+- **The studio starts on a subscription with the same command as the sibling harnesses**, through a new
+  `subscription` extra on `diff-sentry-studio`.
+- **`/v1/config` no longer shows a subscription analyst as the classifier**, since no run can use one.
+
+## 0.2.0
+
+### Added
+- **The planner and analyst can run on a Claude Pro/Max subscription** by setting `DS_ROOT_LM` /
+  `DS_SUB_LM` to `claude-agent-sdk/<model>`; this needs `uv sync --extra subscription`, a logged-in
+  Claude Code CLI and no `ANTHROPIC_API_KEY`.
+- **The studio has a page-height, three-column layout with a Verdict / Indicators / Change switch**,
+  and the Change view reads the normalized content from the run's own trace.
+
+### Changed
+- **The classifier must stay on an OpenAI-compatible endpoint**: `config.from_env` rejects a
+  `claude-agent-sdk/…` classifier, set directly or inherited from `DS_SUB_LM`, so a subscription-only
+  run is not supported.
+
+## 0.1.0
+
+The initial release: classify a change into a judgement-only verdict, union the deterministic indicator
+evidence on read (MF3), build the response, emit the SIEM signal host-side, and export reward-free
+trajectories, all testable offline. Includes the metadata sandwich (MF1), the GitHub-allowlisted opt-in
+enrichment fetch (MF2), the pure-Python indicator suite, the `deep_classify` second-stage seam,
+progressive-disclosure attack skills, an offline hackerbot-claw reproduction, and the studio console.