ja4plus 1.2.0__tar.gz → 1.2.2__tar.gz

ja4plus-1.2.2/.claude/rules/agent-reports.md

@@ -0,0 +1,157 @@
+# What a worker reports about the agents it spawns
+
+**A worker spawns review agents, and an agent that never returns is a normal event.** The
+worker then writes one comment that stands as the record of the review. This file states
+what that comment says about an agent that returned nothing.
+
+**Warning: read this file before you write a self-review comment.** #720 records the defect
+that earned it. A worker on #613 spawned two review agents. One reported and one never did,
+and the worker wrote up the agent that never reported as though it had.
+
+## The rule
+
+1. A report an agent did not return is reported as absent.
+2. A worker names the agent that reported, and it names the agent that did not.
+3. An absent report is a normal outcome and it refuses nothing.
+
+**A worker that ran the review itself in place of the absent agent says so.** That sentence
+is the whole repair, and it costs one line.
+
+**Warning: rule 3 binds the reader of the comment as well.** An absent report carries these
+three consequences.
+
+- It refuses no merge.
+- It fails no gate.
+- It earns no tracker issue.
+
+A reader who treats it as a failure gives the next worker a reason to fill the gap.
+
+## Why the rule names the absence as correct
+
+**The worker on #613 reported its own fabrication in the verdict it returned.** It named the
+comment and it named the exact sentences. The project manager corrected the comment at
+https://github.com/Crank-Git/ja4plus/pull/718#issuecomment-5305142104, and it quoted the
+superseded text rather than deleting it.
+
+**A rule that punishes the report rather than the shape removes the one signal that found
+this defect.** No gate of this project reads whether a sentence about a review is true. The
+worker's own report is therefore the one detection this defect class has. The rule names
+the absence as the correct outcome, and it leaves a worker one cheap true thing to say.
+
+**The census of 2026-08-16 measured that the absence is common and that workers report it
+plainly.** The corpus holds 17 comments that state a review agent returned nothing, and 10
+of them use the word `stall`. Each one states what the worker did instead. One record of
+the same corpus counts nine stalls in one session. The rule writes down a practice this
+project already holds.
+
+## Where the repair belongs
+
+**The repair belongs in two places, and this change makes one of them.**
+
+| Home | What it holds | This change |
+|---|---|---|
+| `.claude/rules/agent-reports.md` | The rule, the reason, the census, and the limit | Written here |
+| `agents/issue-worker.md` of the `issue-flow` plugin | The same rule beside the step that spawns the review agents | Named, and no line changed |
+
+**The plugin is outside this repository, so #720 names the file and it edits no line of
+it.** Step 3 of the runbook spawns the review agents. It opens `**Self-review**`, and it
+directs the worker to review by specialist lens through Sonnet children. That step names no
+outcome for a review agent that never returns. A second copy of the file stands at
+`skills/issue-flow/references/issue-worker.md` of the same plugin.
+
+**Warning: the rule reaches a worker of another repository only through the plugin.** This
+file binds a worker of this repository alone, because a worker reads the rules of the
+repository it works in. The maintainer owns the plugin change.
+
+## The census of 2026-08-16
+
+**#720 asks whether any earlier record of this repository carries the same shape.** This
+section reports the census that answers it.
+
+**Count.** The census read 1842 records. The provider returned each count on 2026-08-16.
+
+- 1101 issue comments. That endpoint holds every pull-request conversation comment.
+- 741 issue and pull-request bodies.
+- 0 pull-request review comments.
+
+**Method.** The census ran in two passes. The first pass matched every record against a
+pattern of two parts. The first part matches one of the literals `reviewer`, `lens`,
+`lenses`, `review agent`, `review child`, `children` and `Sonnet`. The second part matches a
+verb of finding. It selected 88 comments and 7 bodies.
+
+The second pass read each selected record in full, and it looked for four signals.
+
+- A quotation of an external document that the record attributes to a review agent.
+- A count that the record attributes to a review agent.
+- A record that reports findings from more agents than it states ran.
+- A plain statement that an agent returned nothing.
+
+Two Sonnet children read 44 comments each. **Both children reported.** The worker read the
+7 bodies itself.
+
+**Bound.** The census reads the provider records of this repository alone. It reads no
+session transcript, so it cannot compare a write-up against the reports a worker received.
+It therefore finds the shape in three cases alone.
+
+- The record contradicts itself.
+- The record quotes a source that the source does not hold.
+- The worker reported the fabrication.
+
+**A fabrication that stays internally consistent and quotes nothing checkable reaches no
+reader of this corpus.** The census reports a clean corpus over that class, and it measures
+none of it.
+
+**Finding.** One record of 1842 carries the shape, and that record earned #720. It is the
+comment at
+https://github.com/Crank-Git/ja4plus/pull/718#issuecomment-5305142104. It attributed these
+four things to an agent that never reported.
+
+- A count of 26 re-measured claims.
+- A finding of no wrong claim.
+- One claim the agent declined to reproduce.
+- A quotation of RFC 9000 Section 12.2.
+
+**Every other record is a clean negative, and the clean negative is the result this section
+reports.**
+
+**Two records sit next to the shape and neither one is it.**
+
+- The comment at https://github.com/Crank-Git/ja4plus/pull/561#issuecomment-5246016733
+  states that a read by lens returned six findings, and it then itemizes five. All three
+  lenses reported, and two of them reported nothing. The mismatch is a wrong count and it
+  is no fabricated report.
+- The comment at https://github.com/Crank-Git/ja4plus/pull/222#issuecomment-5224677084
+  states that two child agents never reported, and it then reports a review the worker ran
+  again itself. It carries the date 2026-08-08, so it holds rule 2 and rule 3 eight days
+  before this file states them.
+
+## No case of this repository refuses this shape
+
+**No case of this repository refuses a fabricated review report, and no case here can.** A
+guard that guards nothing costs a reader more than a stated absence, so this section states
+the absence.
+
+**A case would need the record of which agents returned, and that record is the session
+transcript.** The transcript lives outside this repository, git tracks no copy of it, and a
+pull-request comment states no such record either. A case therefore compares the write-up
+against nothing.
+
+**A fabricated write-up is well-formed text.** It names lenses, it states counts, and it
+reads like a report the worker received. No property of the text parts it from a true
+report, so a pattern that matched it would match every honest self-review beside it.
+
+**`tests/test_agent_report_absence_rule.py` holds every claim of this file that a case can
+read.** These are the claims it reads.
+
+- The file exists, and it states the three rules of `## The rule`.
+- The file states the reason that `## Why the rule names the absence as correct` holds.
+- The file names the plugin file, and this repository tracks no copy of that file.
+- The census states a count, a method, a bound and a finding.
+- The file repeats no heading of `.claude/rules/conformance.md`.
+
+**That module reads no comment of the provider**, because the suite reads the working tree.
+
+**`.claude/rules/conformance.md` states the same discipline for the conformance suite**,
+under `## What a green conformance run does not measure`. #736 wrote that section on
+2026-08-16 and this file repeats no sentence of it. The two readings share one rule: where a
+case cannot read the shape, record what stays unmeasured.

{ja4plus-1.2.0 → ja4plus-1.2.2}/.claude/rules/batch-gate.md

@@ -31,13 +31,20 @@ the promotion, and it accepted no member pull request, so a pull request into an
 integration branch created no run at all. Pull request #519 carried a keyword-free head
 into `batch/510-dry-run-and-gates` and the provider held no run for it.
 
-**A check that reaches the batch pull request alone can pass by construction.**
-`tests/test_round_entry_existence.py` fails a change set that edits a tracked file and
-records no round. A batch pull request reads its change set against the tip of `dev`, and
-every member of a batch has already recorded a round, so that check finds an entry whatever
-one member did. **The member pull request is the change set the check exists to refuse, and
-the older filter kept it away from the job.** Read a new check against this shape before
-you trust it.
+**A check that reaches the batch pull request alone can pass by construction.** Read a new
+check against that shape before you trust it. #438 measured it on 2026-08-10, and the
+paragraph below records that reading. The sentences are quoted rather than rewritten.
+
+> `tests/test_round_entry_existence.py` fails a change set that edits a tracked file and
+> records no round. A batch pull request reads its change set against the tip of `dev`, and
+> every member of a batch has already recorded a round, so that check finds an entry whatever
+> one member did. **The member pull request is the change set the check exists to refuse, and
+> the older filter kept it away from the job.**
+
+**#727 superseded the example on 2026-08-15, and it left the shape standing.** That issue
+moved the round mandate from the change set to the batch pull request, so a member pull
+request records no round and this check refuses none.
+`## A round is a batch, and the batch pull request records it` below states the model.
 
 **The widened filter costs no run that the batch model saved.** A member commit ends with
 the keyword, so a member pull request still creates no run. Under the widened filter, a
@@ -242,27 +249,72 @@ every pull request into `dev` and it filters no path. `.github/workflows/docs-bu
 filters four paths, so the gate requires no run of it and a red run of it still refuses
 the merge.
 
-## Assign every round number at the batch gate
+## A round is a batch, and the batch pull request records it
 
-**Warning: assign a round number at the batch gate, and never at a sub-merge.** A
-sub-merge is the merge of one member branch into the integration branch. The project
-manager assigns the numbers of a whole batch in one pass, immediately before the batch
-pull request. `dev` holds a fixed row count at that moment, so the pass reads one
-sequence that no other writer moves.
+**Warning: record one round on the batch pull request, and none on a member pull
+request.** #727 moved the mandate on 2026-08-15. The project manager writes the entry and
+the row at the batch gate, immediately before the batch pull request, and it assigns the
+number in the same pass. `dev` holds a fixed row count at that moment, so the pass reads
+one sequence that no other writer moves.
 
-A member writes the literal `TBD` in place of its round number. The `TBD` reaches two
-records, and it stays in both through every sub-merge.
+The round reaches two records, and one number covers both.
 
-1. The entry of `CHANGELOG.md`, as `Round TBD.`.
-2. The Changelog row of `docs/specs/spec.md`, as `| TBD | 2026-08-10 | ... |`.
+1. The entry of `CHANGELOG.md`, as `Round 262.`.
+2. The Changelog row of `docs/specs/spec.md`, as `| 262 | 2026-08-15 | ... |`.
 
 `tests/test_changelog_round_agreement.py` holds the two records against each other, so an
-assignment that covers one file alone fails a case. An integration branch carries one
-`TBD` for each member that has not reached the gate, and every one of them is correct.
+assignment that covers one file alone fails a case.
+
+**#727 measured what the older model cost.** One issue recorded one round, so
+`tests/test_round_entry_existence.py` failed every change set that edited a tracked file
+and recorded no round. Each member therefore wrote the two most contended files of the
+repository, and each member then conflicted with every other member on them. A read of
+2026-08-15 covered the last 300 commits of `master`. 192 of them touch
+`docs/specs/spec.md` and 186 touch `CHANGELOG.md`, against 56 that touch a file under
+`ja4plus/`.
+
+**Warning: the 261 rounds already recorded stay exactly as they are.** They record past
+measurements and `.claude/rules/ste.md` bars a rewrite of such a record. The new model
+begins at the next round this project assigns.
+
+### Which change set the mandate reads
+
+`tests/test_round_entry_existence.py` reads the branch the change set belongs to, and
+`records_a_round` holds the condition. A branch whose name opens with `batch/` or `epic/`
+records a round. Every other branch records none, and the reading refuses no round it
+finds on one.
+
+**The two prefixes match the two patterns of the base-branch filter above.** One model
+therefore names an integration branch in the filter and in the mandate.
+
+**The `test` job names that branch in `ROUND_ENTRY_BRANCH`, because a run of a pull request
+checks out a detached merge commit.** `git rev-parse --abbrev-ref HEAD` then answers the
+literal `HEAD` and names no branch. The case would then skip on every job, and `skip-gate`
+would fail the run. The step `Name the branch the change set belongs to` reads
+`github.head_ref` first and `github.ref_name` second. The two together name the head branch
+on every event the workflow accepts.
+
+### One guard still takes a record from a member
+
+**Warning: the routine `TBD` sweep goes out with the older model, and one exception keeps
+the form.** A member that writes no round record leaves nothing to assign later, so the
+sweep covers no member of a routine batch.
+
+**`tests/test_breaking_change_record.py` requires a record from the member that trips it.**
+It requires that `CHANGELOG.md` and `docs/specs/spec.md` each record the Python floor the
+package states. #575 moved that floor and met the result: a reader that demanded a number
+could not pass on the branch that made the move. Such a member writes `Round TBD.` and the
+matching row, and the project manager assigns the number at the batch gate.
+
+**#395 records why that guard stands.** A comparison between two records finds no change
+that is absent from both of them. The move of the floor from 3.8 to 3.9 was such a
+change. #727 therefore kept the guard, and it kept the `TBD` form the guard reads.
+
+### The race the older model measured
 
 **The round sequence is global to the repository, and a sub-merge is an event of one
-batch.** Two live integration branches therefore assign from one sequence at once, and
-neither branch reads the rows of the other until that other branch merges. #482 measured
+batch.** Two live integration branches therefore assigned from one sequence at once, and
+neither branch read the rows of the other until that other branch merged. #482 measured
 the result on 2026-08-10, at the sub-merge gate of #456.
 
 ```
@@ -270,9 +322,9 @@ AssertionError: the Changelog holds 169 rows and its highest round is 173
 assert 169 == 173
 ```
 
-**A project manager who assigns 168 and 169 on the second branch writes two rows numbered
-168 and two numbered 169.** That state merges cleanly, and the rule above removes it
-rather than reports it.
+**#727 removes that race for every routine member.** One batch writes one round at its own
+gate. The project manager runs one gate at a time, so no second writer moves the sequence
+between the read and the write.
 
 **Warning: a wrong pairing survives the row-count rule, so read the contiguity case
 instead.** `row count == highest round` reads a table that carries 168 twice and 170
@@ -281,7 +333,8 @@ pairing.
 `tests/test_specification_changelog.py::test_the_changelog_assigns_every_round_from_one_to_the_row_count`
 requires the rounds 1 to the row count, each on one row, and
 `test_the_row_count_rule_passes_on_a_table_that_repeats_a_round` holds the measurement of
-the older rule.
+the older rule. **That case stays.** It caught the duplicate rounds of #482, and it is
+cheap under the new model.
 
 **One integration branch at a time also removes the race, and this project declines that
 order.** It costs the concurrency the batch model exists to provide. #482 records the

{ja4plus-1.2.0 → ja4plus-1.2.2}/.claude/rules/conformance.md

@@ -62,9 +62,106 @@ method name plus an occurrence counter.
 method that emits more fingerprints than the reference is a defect, and so is one that
 emits fewer.
 
+## What a green conformance run does not measure
+
+**Warning: a green conformance run states nothing about the frame that carries a value.**
+The suite compares one value for each stream, and it never compares the packet that
+produced it. #736 measured the limit on 2026-08-16 and this section records it.
+
+**#606 moved seven values from one frame to another, and the suite discriminated none of
+them.** That issue moved the QUIC `JA4L-S` emission from the packet that fills point `B`
+to the packet that fills point `D`. #736 restored the point `B` emission and ran the suite
+again. The three counts held at 1676 passed, 142 skipped and 138 xfailed under the change
+and under the restored defect. These are the seven moves.
+
+| Capture | The move |
+|---|---|
+| `chrome-cloudflare-quic-with-secrets.pcapng` | 49 to 52 |
+| `ssh2.pcapng` | 1140 to 1147 |
+| `tls3.pcapng` | 144 to 147 |
+| `tls3.pcapng` | 149 to 153 |
+| `tls3.pcapng` | 155 to 162 |
+| `tls3.pcapng` | 159 to 167 |
+| `tls3.pcapng` | 303 to 312 |
+
+### One of the four reference sources states a frame
+
+**The conformance value comparison reads the one source that frames nothing.** A per-frame
+comparison is possible only where a source states the frame, and #736 read all four.
+
+| Source | States a frame | Values |
+|---|---|---|
+| FoxIO Python expected output, `tests/foxio_vectors/*.json` | No | 1203 |
+| FoxIO Rust snapshots, `tests/foxio_vectors/rust_expected/*.snap` | No | 460 |
+| Zeek baselines, `tests/foxio_vectors/zeek_expected/` | No | 7 baselines |
+| FoxIO Wireshark dissector, `tests/foxio_vectors/wireshark_expected/*.json` | Yes, `frame.number` | 724 |
+
+**The first three key a value on the stream or on the connection.** A Zeek baseline names
+`orig_pkts` and `resp_pkts`, and each one counts the packets of a connection rather than
+names one of them. **The dissector frames every value it writes**, and #736 measured 724
+framed values and none unframed across 26 files.
+
+**The conformance suite builds all 1203 of its value cases from the first source.** No case
+of the suite can read a frame, because the source it reads states none.
+
+### Why the suite compares no frame
+
+**The suite compares the FoxIO Python reference, and the dissector holds a different value
+set.** A per-frame comparison reads a new source. It therefore adds no discrimination to
+any case the suite runs today.
+
+**#736 measured what that comparison would report on 2026-08-16.** The measurement ran the
+`Processor` over each of the 26 captures this project holds, it numbered each packet, and
+it read the 445 dissector values of a hashed form against the result. **Warning: the three
+counts below are one measurement, and no case holds them.** Take them again before you
+build on them.
+
+| Reading | Values |
+|---|---|
+| The value agrees and the frame agrees | 206 |
+| The value agrees and the frame differs | 136 |
+| This project produces no such value | 103 |
+
+**The 136 frame disagreements are values this project already produces correctly.** Each
+one would enter `tests/foxio_deviations.json` as a new entry. Each entry would record a
+difference this project has already ruled.
+
+**The TCP `JA4L` and `JA4LS` values hold 70 of the 136.** The dissector writes each one on
+a later frame than this project, and none of the 70 is a QUIC value. **A comparison whose
+largest class is a recorded divergence measures the register and not the code.**
+
+**The frame is an artifact of one dissector, and the value is what the standard defines.**
+Two FoxIO implementations produce the same value on different packets, and neither one is
+wrong. This project therefore declines the per-frame comparison in the conformance suite.
+
+### Where the frame is measured instead
+
+**A frame this project rules on gets a case of its own.**
+`tests/test_ja4l_quic_point_d_emission.py` holds the frame of every QUIC `JA4L` value
+against `frame.number` of the dissector, and it runs in the unit suite. #736 restored the
+point `B` emission and measured 8 failures in that module, against 0 in the conformance
+suite.
+
+**Warning: leave that module in the unit suite, and never move it to the conformance
+suite.** The `test` job runs the unit suite on five environments. `.github/workflows/test.yml:86-91`
+holds that matrix: `ubuntu-latest` on Python 3.10, 3.11, 3.12 and 3.13, and `macos-latest`
+on Python 3.12. The `conformance` job runs the conformance suite on one environment. A move
+would therefore take four readings away from the one frame guard this project holds. #736
+declined the move on that reading.
+
+**Warning: the count of five is the matrix after #575, and an older record states six.**
+That issue dropped Python 3.9 on 2026-08-10. `.claude/rules/batch-gate.md` records a
+measurement of that date over six jobs, and that record stays exactly as it is. Read the
+workflow for the present count, and never a record of a past measurement.
+
+**Warning: read a frame ruling against the unit suite, and never against the conformance
+counts.** `tests/test_conformance_frame_discrimination.py` holds this whole reading. A
+source that starts to state a frame therefore fails a case there, and it leaves no reader
+with a stale rule.
+
 ## When the FoxIO reference holds a defect
 
-The FoxIO reference decides behaviour. It does not decide behaviour that the reference
+The FoxIO reference decides behavior. It does not decide behavior that the reference
 itself produces by accident.
 
 **A defect is proven, never asserted.** Instrument the FoxIO implementation at the pinned
@@ -92,6 +189,116 @@ by analogy.
 
 Decided on 2026-08-07. #96, #97 and #105 are the first three.
 
+## What a delegated session may rule
+
+**The user delegates a session to a project manager, and this section states what that
+delegation permits.** The user granted two delegations, and both hold today. A question
+that fails both belongs to the user.
+
+| Delegation | Date | What it reaches | Where the delegation lives |
+|---|---|---|---|
+| The narrow delegation | 2026-08-12 | A schema violation. | `Crank-Git/ja4plus-go#246`, and #597 here |
+| The recording delegation | 2026-08-15 | A reading this project already holds. | The ruling comments of #595, #607, #608 and #613 |
+
+**A ruling lands in this repository and in the port together, or in neither.**
+`.claude/rules/parity.md` of `Crank-Git/ja4plus-go` states that rule, and
+`.claude/rules/rulings.md` of that repository holds the port half of the narrow
+delegation.
+
+### The narrow delegation of 2026-08-12
+
+**A schema violation has one right answer, and a reference split has none.** That sentence
+is the boundary. The project manager rules a schema violation under this delegation. It
+rules no reference split, and it rules no other question.
+
+**A delegated ruling is a ruling, and never a reading.** A reading concludes what one
+source states. A delegated ruling settles what this project does where a published FoxIO
+value contradicts a published FoxIO rule. No source settles that question, because FoxIO
+publishes both of them.
+
+A project manager makes a delegated ruling only where every one of these is true.
+
+1. A published FoxIO rule states the answer. The rule reaches the material under
+   `technical_details/`, the transcription of it under `docs/specs/foxio/<METHOD>.md`, or
+   a FoxIO reference implementation.
+2. Every FoxIO implementation enforces that rule. One implementation that departs makes
+   the question a reference split, and this delegation bars a reference split.
+3. A recorded measurement proves the violation, and each citation names a file and a line.
+   `## When the FoxIO reference holds a defect` above states that a defect is proven and
+   never asserted.
+4. The record of the ruling carries a provisional marker, and it names the issue.
+5. The record names a reversal path, so the user reverses the ruling with one action.
+
+**A question that fails one condition leaves this delegation.** The project manager reads
+it against the recording delegation below.
+
+### The recording delegation of 2026-08-15
+
+**The user granted a second delegation on 2026-08-15.** Four ruling comments each state it
+in these words: #595, #607, #608 and #613. This file quotes them, and it rewrites no word
+of the delegation.
+
+**Warning: never open a line of this file with an issue number.** The section reader of
+`tests/test_ported_pattern_cost.py` reads a line that opens with `#` as a heading, and it
+then stops at that line. A paragraph below such a line reaches no case.
+
+> The maintainer granted a delegated session this carve-out on 2026-08-15: a delegated
+> session may rule where the decision preserves the present behaviour, moves no
+> fingerprint, and records an existing reading as a divergence register row. A decision
+> that moves a value, that forks from `ja4plus-go`, or that changes the scope of the
+> project stays with the maintainer.
+
+**The delegation states three limits, and a permitted question meets every one of them.**
+
+- The ruling keeps the present behavior of this project.
+- The ruling moves no fingerprint value.
+- The ruling writes one row of the divergence register.
+
+**A ruling that moves a value stays with the user.** A ruling that parts this project from
+the port stays with the user. A ruling that changes the scope of this project stays with
+the user.
+
+**The project manager ruled each of the four issues under this delegation on 2026-08-15,
+and no line of a fingerprinter moved.** #595 records the JA4L eviction of the QUIC path, #607 records the
+JA4H emission frame, #608 records the JA4SSH packet selection, and #613 records the one
+QUIC packet each datagram fills point C from.
+
+### How the two delegations relate
+
+**The two delegations reach different questions, and neither one repeals the other.**
+
+- The narrow delegation settles what this project does, and it can move a fingerprint
+  value. It therefore bars a reference split: a wrong answer there makes this project
+  answer differently from a FoxIO implementation on the same bytes.
+- The recording delegation records what this project already does, and it moves no
+  fingerprint value. A reference split therefore reaches it. #595 and #613 are each such a
+  question, and each ruling of 2026-08-15 left every line of the fingerprinter as it
+  stood.
+- **A reference split is never delegable as a schema violation.** Condition 2 of the
+  narrow delegation bars it, and no reading of the evidence removes that bar.
+- **Every delegated ruling is provisional under both delegations**, and each one names a
+  reversal path.
+
+**A question that fails both delegations belongs to the user.** The project manager labels
+that issue `status:needs-feedback`. It records the reading it holds. It builds nothing that
+depends on the answer.
+
+**The user confirms a delegated ruling, or reverses it.** A delegated ruling that the user
+has not confirmed stays provisional. A later reader reads a provisional ruling as
+unconfirmed, and never as settled.
+
+### The worked example both repositories share
+
+`Crank-Git/ja4plus-go#223` is the first delegated ruling, and the user confirmed it on
+2026-08-12. A published FoxIO value contradicts a rule that four implementations enforce.
+`zeek/ja4ssh/main.zeek:63`, `wireshark/source/packet-ja4.c:400`, `rust/ja4/src/ssh.rs:284`
+and `python/ja4ssh.py:51` each state that the JA4SSH mode is `0` when the side sent no SSH
+packet. `python/test/testdata/ssh-scp-1050.pcap.json` holds `c112s1460_c0s200_c36s0`,
+which pairs a client mode of `112` with a client packet count of `0`.
+
+**This project already reads the mode of the window alone**, and #96 holds that rule. The
+narrow delegation therefore moved no fingerprint here, and it moved no exported name.
+
 ## When the FoxIO material is ambiguous
 
 Eleven of the twelve methods are published as an image. Only JA4 holds a complete text
@@ -350,6 +557,33 @@ Where FoxIO specifies nothing — a field name, a default, a subcommand — the
 `Crank-Git/ja4plus-go` has already shipped a choice. Adopt it. Where FoxIO does specify,
 FoxIO wins, even against the port. `docs/specs/spec.md` holds the divergence register.
 
+### A pattern the port ships carries no statement of its cost
+
+**Parity rule 2 adopts the interface the port ships. It adopts no statement of cost.** Go
+runs a finite automaton, and it backtracks nowhere. Python `re` backtracks. The two
+languages therefore read one pattern at two costs. The rule that carries the shape carries
+no proof that the shape is safe against hostile input.
+
+**Warning: a pattern that is safe in the port is a pattern this project has not
+measured.** Measure a regular expression this project takes from the port against hostile
+input before it lands. State the measurement where the change records its evidence.
+
+**#612 followed parity rule 2 literally, and it shipped a backtracking defect to a
+branch.** Its own self-review found the defect and measured it. `GET a` plus 32000 spaces
+plus `HTTPX` cost **3017.9 milliseconds** under the ported form. The repaired form reads
+the same payload at **0.630 milliseconds**. `REQUEST_LINE_LIMIT` of
+`ja4plus/utils/http_utils.py` reads 8192. `is_http_request` reads that many bytes of every
+TCP payload, so one crafted packet bought about 200 milliseconds of processor time.
+
+**The rule reaches every construct whose cost differs between a finite automaton and a
+backtracking engine.** A regular expression is the case this project has met.
+
+**Warning: an atomic group states the bound directly, and this project cannot write
+one.** Python accepts `(?>...)` from release 3.11, and `pyproject.toml:24` reads
+`requires-python = ">=3.10"`. A repair that raises the floor of the package is a ruling
+for the user. Verified against https://docs.python.org/3/library/re.html (retrieved
+2026-08-15).
+
 ## Measuring coverage
 
 Use the **directory** form, `--cov=ja4plus`. For one file, use the **path** form,
@@ -359,6 +593,6 @@ Use the **directory** form, `--cov=ja4plus`. For one file, use the **path** form
 QUIC cases fail, and the cause is not in this project. `coverage` resolves a dotted source
 name inside a `sys_modules_saved()` block, which imports `ja4plus`, scapy and
 `cryptography` and then deletes them. The second `cryptography` import builds Python
-classes the loaded Rust extension does not recognise, so every AES cipher raises
+classes the loaded Rust extension does not recognize, so every AES cipher raises
 `UnsupportedAlgorithm`, and the second scapy import changes the dissection of a committed
 capture. #177 holds the measurement, and Changelog round 47 records it.

{ja4plus-1.2.0 → ja4plus-1.2.2}/.claude/rules/external-apis.md

@@ -42,7 +42,7 @@ Code inside this repository is different. Read the code.
 
 ## Rules specific to this project
 
-**FoxIO is the authority on behaviour.** The specification decides intent and schema. The
+**FoxIO is the authority on behavior.** The specification decides intent and schema. The
 vectors decide the exact bytes where intent runs out. A provable reference defect is
 declined and recorded.