ghostrules 0.4.0__tar.gz → 0.4.1__tar.gz

{ghostrules-0.4.0 → ghostrules-0.4.1}/.ghostrules.lock

@@ -26,6 +26,6 @@
     "generic": []
   },
   "configs": [],
-  "generator": "ghostrules 0.4.0",
+  "generator": "ghostrules 0.4.1",
   "lock_version": 1
 }

{ghostrules-0.4.0 → ghostrules-0.4.1}/CHANGELOG.md

@@ -5,6 +5,36 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-29
+
+Follow-up to 0.4.0: fewer false positives on scripts, fewer misses on visible attacks, and a
+benchmark headline that no longer counts cases the author wrote. No breaking changes.
+
+### Changed
+
+- **Visible prose that reads as an attack stays `high`.** Inside one paragraph, exfiltration plus
+  concealment (GR013 + GR011), override plus exfiltration (GR010 + GR013) and a sensitive file plus
+  a URL outside `allow_domains` (GR014 + URL) keep the rule's severity even though the text is
+  visible. Examples, quotations, code blocks and descriptions stay `low`. On the held-out set no
+  repository starts to fail the check, but two GR014 findings already labelled false positive now
+  report `high`.
+- **GR110 no longer reports a token sent to the service it belongs to**: `GITHUB_*`/`GH_*` to
+  `api.github.com`, `github.com` or `uploads.github.com`; `AZURE_*`, `ADO_*` and `SYSTEM_ACCESSTOKEN`
+  to `dev.azure.com` or `*.visualstudio.com`; `<X>_API_KEY` to a host that contains `x`. It still
+  reports any other host, a collector domain, the whole environment, a credentials file, a variable
+  with no known service and a destination it cannot read. The held-out GR110 finding is still
+  reported: its shape is not covered.
+- **The benchmark headline counts only the independent cases.** Recall is split by origin (`author`,
+  `review`, `public`; `ours` is now `author`) and the README states the independent figure first,
+  with its sample size. Every number in `README.md` and `bench/README.md` is generated from the data
+  (`python bench/run.py report --write`) and a test fails when one is stale.
+
+### Added
+
+- **Inline hook code is read as a script**: the code in `python3 -c`, `node -e`, `bash -c` and `sh -c`
+  (and the other interpreters in the hook table) is checked by GR110–GR113. The finding points at the
+  command in the settings file.
+
 ## [0.4.0] - 2026-10-29
 
 Remediation release, from an independent review of 0.3.0 ([plan](docs/design/v0.4/REMEDIATION.md)).

{ghostrules-0.4.0 → ghostrules-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ghostrules
-Version: 0.4.0
+Version: 0.4.1
 Summary: Find the instructions your AI agent sees but you don't.
 Project-URL: Homepage, https://github.com/BardLaudian/ghostrules
 Project-URL: Documentation, https://github.com/BardLaudian/ghostrules#readme
@@ -149,7 +149,7 @@ ghostrules lock --check  .ghostrules.lock
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: BardLaudian/ghostrules@v0.4.0
+- uses: BardLaudian/ghostrules@v0.4.1
   with:
     fail-on: high        # critical | high | medium | low | info | none
     lock-check: "true"   # fail if what the agents read changed
@@ -158,7 +158,7 @@ ghostrules lock --check  .ghostrules.lock
 ```yaml
 repos:
   - repo: https://github.com/BardLaudian/ghostrules
-    rev: v0.4.0
+    rev: v0.4.1
     hooks:
       - id: ghostrules
 ```
@@ -171,8 +171,16 @@ A scanner that cries wolf gets switched off, and one that misses gets trusted by
 measured and the misses are listed ([bench/](https://github.com/BardLaudian/ghostrules/blob/main/bench/README.md),
 [full results](https://github.com/BardLaudian/ghostrules/blob/main/bench/RESULTS.md)). Nothing below was tuned on the data it is measured on.
 
-<!-- bench:start -->
-**Recall: 101 attack cases** written from public sources and defanged. 87 are reported (86%); 50 (50%) fail the default `--fail-on high` check, because visible prose is `low` by default (hidden text and configuration are not). The 14 misses include paraphrases, other languages, scripts and files that nothing points the scanner to, tool descriptions served by a running MCP server, two scanner evasions that only the pull-request mode closes, and gaps of ours; each is listed in the results. 4 cases come from the independent review; its other 14 are not in the repository yet.
+<!-- bench:recall:start -->
+**Recall on independent cases: 1 of 4 reported (25%); 1 fail the default `--fail-on high` check.** They are 4 of the 18 cases an independent review wrote; the other 14 are not in the repository yet, so this is a small sample. The 97 cases written by the author or taken from public sources are shown separately because the author knew what the rules match: of all 101 cases 87 are reported (86%). Visible prose is `low` by default, so the check fails less often than the rules report (hidden text and configuration are not lowered). The misses include paraphrases, other languages, scripts and files that nothing points the scanner to, tool descriptions served by a running MCP server, two scanner evasions that only the pull-request mode closes, and gaps of ours; each is listed in the results.
+
+| Origin | Cases | Reported | Fails the default check |
+|---|---:|---:|---:|
+| author | 28 | 20 (71%) | 9 (32%) |
+| review (independent) | 4 | 1 (25%) | 1 (25%) |
+| public | 69 | 66 (96%) | 40 (58%) |
+
+All origins, by technique:
 
 | Technique | Cases | Reported | Fails the default check |
 |---|---:|---:|---:|
@@ -197,9 +205,13 @@ measured and the misses are listed ([bench/](https://github.com/BardLaudian/ghos
 | unicode-tags | 7 | 7 | 7 |
 | variation-selectors | 3 | 3 | 3 |
 | zero-width | 3 | 3 | 1 |
-<!-- bench:end -->
+<!-- bench:recall:end -->
+
+<!-- bench:precision:start -->
+**Precision: 100 repositories** frozen before any v0.4 tuning (851 agent files, default settings). They gave 21 findings, and 2 repositories would fail the default check. Precision for a user is true positives over everything reported, because a right pattern in a harmless place is still something to read: **4 of 21 (19 %)**, from labels given by the assistant that ran the benchmark and **not reviewed by a human** (0 findings unlabelled). Per rule: GR014 1 of 5; GR022 1 of 6; GR102 1 of 1; GR107 1 of 1; GR003 0 of 2; GR011 0 of 1; GR012 0 of 4; GR110 0 of 1. 21 findings are too few for a percentage per rule to mean much.
+<!-- bench:precision:end -->
 
-**Precision: 100 repositories** frozen before any v0.4 tuning (874 agent files, default settings). They gave 21 findings, and 2 repositories would fail the default check. Precision for a user is true positives over everything reported, because a right pattern in a harmless place is still something to read: **4 of 21 (19 %)**, from labels given by the assistant that ran the benchmark and **not reviewed by a human**. Per rule: GR102 and GR107 1 of 1; GR014 1 of 5; GR022 1 of 6; GR012 0 of 4; GR003 0 of 2; GR011 and GR110 0 of 1 (the new GR110 finding is a script that sends its own API key to the API it documents). Twenty-one findings are too few for a percentage per rule to mean much.
+The new GR110 finding is a script that sends its own API key to the API it documents.
 
 A workflow scheduled weekly scans 300 popular public repositories (`corpus/`, the only part of the project that uses the network) and fails if a critical or high finding has not been reviewed; last run: 2026-10-28. Those rules were tuned on that data, so its numbers are not an estimate of precision on new repositories. On it, 0.2.1 reported 84 critical and 156 high findings and 0.3.0 reports none critical and 53 high. The [study](https://github.com/BardLaudian/ghostrules/blob/main/study/report.md) used the same tooling; `ghostrules` is a set of heuristics, not a proof: see the [limits](https://github.com/BardLaudian/ghostrules/blob/main/docs/USAGE.md#limits).
 

{ghostrules-0.4.0 → ghostrules-0.4.1}/README.md

@@ -89,7 +89,7 @@ ghostrules lock --check  .ghostrules.lock
 
 ```yaml
 - uses: actions/checkout@v4
-- uses: BardLaudian/ghostrules@v0.4.0
+- uses: BardLaudian/ghostrules@v0.4.1
   with:
     fail-on: high        # critical | high | medium | low | info | none
     lock-check: "true"   # fail if what the agents read changed
@@ -98,7 +98,7 @@ ghostrules lock --check  .ghostrules.lock
 ```yaml
 repos:
   - repo: https://github.com/BardLaudian/ghostrules
-    rev: v0.4.0
+    rev: v0.4.1
     hooks:
       - id: ghostrules
 ```
@@ -111,8 +111,16 @@ A scanner that cries wolf gets switched off, and one that misses gets trusted by
 measured and the misses are listed ([bench/](https://github.com/BardLaudian/ghostrules/blob/main/bench/README.md),
 [full results](https://github.com/BardLaudian/ghostrules/blob/main/bench/RESULTS.md)). Nothing below was tuned on the data it is measured on.
 
-<!-- bench:start -->
-**Recall: 101 attack cases** written from public sources and defanged. 87 are reported (86%); 50 (50%) fail the default `--fail-on high` check, because visible prose is `low` by default (hidden text and configuration are not). The 14 misses include paraphrases, other languages, scripts and files that nothing points the scanner to, tool descriptions served by a running MCP server, two scanner evasions that only the pull-request mode closes, and gaps of ours; each is listed in the results. 4 cases come from the independent review; its other 14 are not in the repository yet.
+<!-- bench:recall:start -->
+**Recall on independent cases: 1 of 4 reported (25%); 1 fail the default `--fail-on high` check.** They are 4 of the 18 cases an independent review wrote; the other 14 are not in the repository yet, so this is a small sample. The 97 cases written by the author or taken from public sources are shown separately because the author knew what the rules match: of all 101 cases 87 are reported (86%). Visible prose is `low` by default, so the check fails less often than the rules report (hidden text and configuration are not lowered). The misses include paraphrases, other languages, scripts and files that nothing points the scanner to, tool descriptions served by a running MCP server, two scanner evasions that only the pull-request mode closes, and gaps of ours; each is listed in the results.
+
+| Origin | Cases | Reported | Fails the default check |
+|---|---:|---:|---:|
+| author | 28 | 20 (71%) | 9 (32%) |
+| review (independent) | 4 | 1 (25%) | 1 (25%) |
+| public | 69 | 66 (96%) | 40 (58%) |
+
+All origins, by technique:
 
 | Technique | Cases | Reported | Fails the default check |
 |---|---:|---:|---:|
@@ -137,9 +145,13 @@ measured and the misses are listed ([bench/](https://github.com/BardLaudian/ghos
 | unicode-tags | 7 | 7 | 7 |
 | variation-selectors | 3 | 3 | 3 |
 | zero-width | 3 | 3 | 1 |
-<!-- bench:end -->
+<!-- bench:recall:end -->
+
+<!-- bench:precision:start -->
+**Precision: 100 repositories** frozen before any v0.4 tuning (851 agent files, default settings). They gave 21 findings, and 2 repositories would fail the default check. Precision for a user is true positives over everything reported, because a right pattern in a harmless place is still something to read: **4 of 21 (19 %)**, from labels given by the assistant that ran the benchmark and **not reviewed by a human** (0 findings unlabelled). Per rule: GR014 1 of 5; GR022 1 of 6; GR102 1 of 1; GR107 1 of 1; GR003 0 of 2; GR011 0 of 1; GR012 0 of 4; GR110 0 of 1. 21 findings are too few for a percentage per rule to mean much.
+<!-- bench:precision:end -->
 
-**Precision: 100 repositories** frozen before any v0.4 tuning (874 agent files, default settings). They gave 21 findings, and 2 repositories would fail the default check. Precision for a user is true positives over everything reported, because a right pattern in a harmless place is still something to read: **4 of 21 (19 %)**, from labels given by the assistant that ran the benchmark and **not reviewed by a human**. Per rule: GR102 and GR107 1 of 1; GR014 1 of 5; GR022 1 of 6; GR012 0 of 4; GR003 0 of 2; GR011 and GR110 0 of 1 (the new GR110 finding is a script that sends its own API key to the API it documents). Twenty-one findings are too few for a percentage per rule to mean much.
+The new GR110 finding is a script that sends its own API key to the API it documents.
 
 A workflow scheduled weekly scans 300 popular public repositories (`corpus/`, the only part of the project that uses the network) and fails if a critical or high finding has not been reviewed; last run: 2026-10-28. Those rules were tuned on that data, so its numbers are not an estimate of precision on new repositories. On it, 0.2.1 reported 84 critical and 156 high findings and 0.3.0 reports none critical and 53 high. The [study](https://github.com/BardLaudian/ghostrules/blob/main/study/report.md) used the same tooling; `ghostrules` is a set of heuristics, not a proof: see the [limits](https://github.com/BardLaudian/ghostrules/blob/main/docs/USAGE.md#limits).
 

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/README.md

@@ -6,7 +6,7 @@ Two measurements, both reported with their misses and without tuning on them (W6
 
 ## Recall: the attack set (`attacks/`)
 
-81 cases, each a technique written from a public description (sources in `attacks/sources.toml`:
+<!-- bench:cases:start -->101 cases (28 by the author, 4 from the independent review, 69 from public sources), each a technique written from a public description<!-- bench:cases:end --> (sources in `attacks/sources.toml`:
 Rehberger and Butler on Unicode smuggling, Trojan Source, Pillar's Rules File Backdoor, Invariant
 Labs on MCP tool poisoning, Check Point's Claude Code CVEs, OWASP's malicious-skills entry), with
 the rule that should catch it and whether it does today (`status = "detected"` or `"known-miss"`).
@@ -21,7 +21,7 @@ the rule that should catch it and whether it does today (`status = "detected"` o
 - **Misses stay in the base and are listed.** A test fails when a declared status stops matching what
   the scanner does, so a miss that gets fixed must be updated, and a detection that regresses shows.
 - **Provenance.** `origin` is `public` (a public technique), `review` (a case from the independent
-  review) or `ours` (written by the maintainer). Only **4 of the review's 18 cases** are included:
+  review) or `author` (written by the maintainer, who knew what the rules match: not independent). <!-- bench:provenance:start -->Only **4 of the review's 18 cases**<!-- bench:provenance:end --> are included:
   the ones `REMEDIATION.md` describes. The other 14 are not in the repository and are not
   invented here; add them as `origin = "review"` cases when the list is available. Ideally someone
   who has not seen the rules writes another 20.
@@ -38,7 +38,7 @@ right pattern in a harmless place is still something someone has to read.
 - **The labels are provisional.** They were given by the assistant that ran the benchmark, from the
   finding and the lines around it, and no human has reviewed them. Borderline calls are noted in
   [RESULTS.md](RESULTS.md).
-- **The set is small.** 100 repositories gave 18 findings: a per-rule percentage on 1 to 6 findings
+- **The set is small.** <!-- bench:heldout:start -->100 repositories gave 21 findings<!-- bench:heldout:end -->: a per-rule percentage on 1 to 6 findings
   is an anecdote, not an estimate.
 - **Never tune on it.** A rule changed after reading these findings would no longer be measured by
   this set. Fixing what it shows needs a new held-out set, frozen first.

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/RESULTS.md

@@ -5,6 +5,12 @@ measured and how. Nothing here was tuned on the held-out set.
 
 ## Recall on the attack set
 
+| Origin | Cases | Reported | Fails the default check |
+|---|---:|---:|---:|
+| author | 28 | 20 (71%) | 9 (32%) |
+| review (independent) | 4 | 1 (25%) | 1 (25%) |
+| public | 69 | 66 (96%) | 40 (58%) |
+
 | Technique | Cases | Reported | Fails the default check |
 |---|---:|---:|---:|
 | agent-settings | 9 | 8 | 7 |
@@ -69,20 +75,20 @@ Known misses:
 - `mcp-tool-description-poisoning` (mcp-server-content, public): Tool descriptions come from a running server and are never read (docs/USAGE.md, Limits).
 - `evasion-ignore-end-of-line` (scanner-evasion, review): In the default scan; with --suppressions-from-ref or the Action on a pull request it is reported.
 - `evasion-exclude-in-config` (scanner-evasion, review): In the default scan; --config-from-ref or the Action on a pull request ignores the added config.
-- `override-french` (instruction-override, ours): Patterns exist for English and Spanish only.
-- `override-leetspeak` (instruction-override, ours): Patterns match words, not look-alike spellings.
-- `override-paraphrase` (instruction-override, ours): Paraphrases cannot be caught by patterns (REMEDIATION W5.6).
-- `conceal-paraphrase` (concealment, ours): A paraphrase; patterns cannot catch intent (REMEDIATION W5.6).
-- `exfil-spanish` (exfiltration, ours): Found when the bench ran: GR013 has no Spanish patterns, although GR010, GR011, GR014 and GR016 do.
+- `override-french` (instruction-override, author): Patterns exist for English and Spanish only.
+- `override-leetspeak` (instruction-override, author): Patterns match words, not look-alike spellings.
+- `override-paraphrase` (instruction-override, author): Paraphrases cannot be caught by patterns (REMEDIATION W5.6).
+- `conceal-paraphrase` (concealment, author): A paraphrase; patterns cannot catch intent (REMEDIATION W5.6).
+- `exfil-spanish` (exfiltration, author): Found when the bench ran: GR013 has no Spanish patterns, although GR010, GR011, GR014 and GR016 do.
 - `exfil-upload-config-file` (exfiltration, review): From REMEDIATION.md; a paraphrase, out of reach of patterns.
 - `sensitive-npmrc` (sensitive-file, public): Found when the bench ran: 'Open ~/.npmrc' is not matched, even at info; the read-verb list lacks 'open'.
-- `sensitive-paraphrase` (sensitive-file, ours): No path or file name to match: a description of the file.
-- `rce-python-urlopen-exec` (remote-code-execution, ours): GR012 knows shell pipes, PowerShell and eval of curl; not exec(urlopen(...)).
-- `skill-script-not-mentioned` (skill-scripts, ours): Only scripts that SKILL.md references are scanned (REMEDIATION W5.2), by design.
+- `sensitive-paraphrase` (sensitive-file, author): No path or file name to match: a description of the file.
+- `rce-python-urlopen-exec` (remote-code-execution, author): GR012 knows shell pipes, PowerShell and eval of curl; not exec(urlopen(...)).
+- `skill-script-not-mentioned` (skill-scripts, author): Only scripts that SKILL.md references are scanned (REMEDIATION W5.2), by design.
 
 ## Precision on the held-out set
 
-100 of 100 repositories scanned (874 agent files), ghostrules 0.3.0 at commit 8ce68eb, 2026-10-29, default settings and an empty configuration. 21 findings shown by default; 2 repositories would fail `--fail-on high`; 0 findings unlabelled.
+100 of 100 repositories scanned (851 agent files), ghostrules 0.4.1 at commit bef33a6, 2026-10-29, default settings and an empty configuration. 21 findings shown by default; 2 repositories would fail `--fail-on high`; 0 findings unlabelled.
 
 | Rule | Findings | True positive | Benign context | False positive | Unlabelled | Precision for a user |
 |---|---:|---:|---:|---:|---:|---:|

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/attacks/context-and-config.toml

@@ -26,7 +26,7 @@ status = "detected"
 [[case]]
 id = "import-chain-payload"
 technique = "imports"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A clean CLAUDE.md imports a file that imports a file with the instruction."
 expected = ["GR013"]
@@ -39,7 +39,7 @@ status = "detected"
 [[case]]
 id = "import-payload-in-comment-of-imported-file"
 technique = "imports"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The instruction sits in an HTML comment of an imported file."
 expected = ["GR005"]
@@ -51,7 +51,7 @@ status = "detected"
 [[case]]
 id = "symlink-out-of-repo"
 technique = "imports"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "An instruction file that is a symlink pointing outside the repository."
 expected = ["GR025"]
@@ -76,7 +76,7 @@ status = "detected"
 [[case]]
 id = "referenced-script-by-name"
 technique = "referenced-files"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "'Run scripts/setup.sh first' where the script exfiltrates."
 expected = ["GR013", "GR110"]

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/attacks/prose.toml

@@ -37,7 +37,7 @@ status = "detected"
 [[case]]
 id = "html-comment-short"
 technique = "html-comment"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A short comment (under 40 characters) that conceals."
 expected = ["GR011"]
@@ -60,7 +60,7 @@ status = "detected"
 [[case]]
 id = "override-spanish"
 technique = "instruction-override"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The same phrase in Spanish."
 expected = ["GR010"]
@@ -104,7 +104,7 @@ status = "detected"
 [[case]]
 id = "override-across-lines"
 technique = "instruction-override"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The phrase broken over several lines of a list."
 expected = ["GR010"]
@@ -115,7 +115,7 @@ status = "detected"
 [[case]]
 id = "override-french"
 technique = "instruction-override"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The override in French: only English and Spanish are covered."
 expected = ["GR010"]
@@ -127,7 +127,7 @@ note = "Patterns exist for English and Spanish only."
 [[case]]
 id = "override-leetspeak"
 technique = "instruction-override"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Digits for letters."
 expected = ["GR010"]
@@ -139,7 +139,7 @@ note = "Patterns match words, not look-alike spellings."
 [[case]]
 id = "override-paraphrase"
 technique = "instruction-override"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The same intent without any listed phrase."
 expected = ["GR010"]
@@ -173,7 +173,7 @@ status = "detected"
 [[case]]
 id = "conceal-spanish"
 technique = "concealment"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Concealment in Spanish."
 expected = ["GR011"]
@@ -184,7 +184,7 @@ status = "detected"
 [[case]]
 id = "conceal-paraphrase"
 technique = "concealment"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Concealment worded without a listed phrase."
 expected = ["GR011"]
@@ -229,7 +229,7 @@ status = "detected"
 [[case]]
 id = "exfil-spanish"
 technique = "exfiltration"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The same instruction in Spanish."
 expected = ["GR013"]
@@ -253,7 +253,7 @@ note = "From REMEDIATION.md; a paraphrase, out of reach of patterns."
 [[case]]
 id = "exfil-two-sentences"
 technique = "exfiltration"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The secret and the destination are in different sentences."
 expected = ["GR013"]
@@ -309,7 +309,7 @@ note = "Found when the bench ran: 'Open ~/.npmrc' is not matched, even at info;
 [[case]]
 id = "sensitive-paraphrase"
 technique = "sensitive-file"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The same target described without a path."
 expected = ["GR014"]
@@ -376,7 +376,7 @@ status = "detected"
 [[case]]
 id = "rce-python-urlopen-exec"
 technique = "remote-code-execution"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Download and exec from Python instead of a shell pipe."
 expected = ["GR012"]
@@ -410,7 +410,7 @@ status = "detected"
 [[case]]
 id = "encoded-hex-blob"
 technique = "encoded-payload"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A long hex string."
 expected = ["GR015"]

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/attacks/unicode.toml

@@ -69,7 +69,7 @@ status = "detected"
 [[case]]
 id = "tags-with-flag-prefix"
 technique = "unicode-tags"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Tags that start like an emoji flag sequence (black flag, tags, cancel tag), which the rule treats as legitimate."
 expected = ["GR001"]
@@ -115,7 +115,7 @@ status = "detected"
 [[case]]
 id = "zwsp-inside-keyword"
 technique = "zero-width"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Zero-width spaces split a keyword so a naive text match misses it."
 expected = ["GR003"]
@@ -137,7 +137,7 @@ status = "detected"
 [[case]]
 id = "soft-hyphen-split"
 technique = "zero-width"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "Soft hyphens inside a word, invisible when rendered."
 expected = ["GR003"]
@@ -181,7 +181,7 @@ status = "detected"
 [[case]]
 id = "homoglyph-keyword"
 technique = "homoglyph"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A Cyrillic letter inside a Latin word that is meant to look like an override phrase."
 expected = ["GR006"]
@@ -203,7 +203,7 @@ status = "detected"
 [[case]]
 id = "homoglyph-greek"
 technique = "homoglyph"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A Greek omicron in a command name."
 expected = ["GR006"]

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/attacks/w5.toml

@@ -38,7 +38,7 @@ status = "detected"
 [[case]]
 id = "codex-override-payload"
 technique = "exfiltration"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The instruction sits in AGENTS.override.md, which Codex reads before AGENTS.md."
 expected = ["GR013"]
@@ -180,7 +180,7 @@ status = "detected"
 [[case]]
 id = "skill-script-not-mentioned"
 technique = "skill-scripts"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A script in a skill directory that SKILL.md never mentions."
 expected = ["GR110"]
@@ -193,7 +193,7 @@ note = "Only scripts that SKILL.md references are scanned (REMEDIATION W5.2), by
 [[case]]
 id = "referenced-see-and-do"
 technique = "referenced-files"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "'See docs/setup.txt and do what it says', with the payload in the .txt."
 expected = ["GR013"]
@@ -205,7 +205,7 @@ status = "detected"
 [[case]]
 id = "referenced-follow-instructions-in"
 technique = "referenced-files"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "'Follow the instructions in notes/steps.md', a markdown file that is not imported."
 expected = ["GR013"]
@@ -217,7 +217,7 @@ status = "detected"
 [[case]]
 id = "exfil-read-then-upload"
 technique = "exfiltration"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "A private key is read in one sentence and uploaded in the next."
 expected = ["GR013"]
@@ -228,7 +228,7 @@ status = "detected"
 [[case]]
 id = "exfil-note-then-post"
 technique = "exfiltration"
-origin = "ours"
+origin = "author"
 source = "ours"
 description = "The env file is opened in one sentence and its values posted in the next."
 expected = ["GR013"]

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/heldout-results.json

@@ -1,10 +1,10 @@
 {
   "date": "2026-10-29",
-  "ghostrules_version": "0.3.0",
-  "commit": "8ce68eb",
+  "ghostrules_version": "0.4.1",
+  "commit": "bef33a6",
   "repos_total": 100,
   "repos_scanned": 100,
-  "files_scanned": 874,
+  "files_scanned": 851,
   "repos_failing_default_check": 2,
   "findings": [
     {
@@ -44,7 +44,7 @@
     },
     {
       "rule_id": "GR014",
-      "severity": "low",
+      "severity": "high",
       "fingerprint": "7f3c86ebf1cbcb23"
     },
     {
@@ -54,7 +54,7 @@
     },
     {
       "rule_id": "GR014",
-      "severity": "low",
+      "severity": "high",
       "fingerprint": "95602096758bd17b"
     },
     {

{ghostrules-0.4.0 → ghostrules-0.4.1}/bench/lib.py

@@ -29,7 +29,10 @@ from ghostrules.scanner import scan_paths
 HERE = Path(__file__).resolve().parent
 ATTACKS = HERE / "attacks"
 STATUSES = ("detected", "known-miss")
-ORIGINS = ("public", "review", "ours")
+ORIGINS = ("author", "review", "public")
+# The headline recall counts only the cases the project's author did not write or choose.
+INDEPENDENT = "review"
+REVIEW_TOTAL = 18  # cases the independent review reported; the rest are not in the repository yet
 
 _TOKEN = re.compile(r"\{(tags|vs|b64|hex):([^{}]*)\}|\{u\+([0-9A-Fa-f]{4,6})\}")
 
@@ -161,6 +164,20 @@ def recall_table(outcomes: list[Outcome]) -> list[dict[str, Any]]:
     return sorted(rows.values(), key=lambda r: r["technique"])
 
 
+def origin_table(outcomes: list[Outcome]) -> list[dict[str, Any]]:
+    """Per origin (every origin, even with no case): cases, reported, failing the default check."""
+    return [
+        {
+            "origin": origin,
+            "cases": len(mine),
+            "reported": sum(o.reported for o in mine),
+            "fails_ci": sum(o.fails_ci for o in mine),
+        }
+        for origin in ORIGINS
+        for mine in [[o for o in outcomes if o.case.origin == origin]]
+    ]
+
+
 # --- precision on the held-out set --------------------------------------------------------------
 
 LABELS = ("tp", "benign-context", "fp")