These are bounded rule results from self-authored fixtures. They verify that the tooling behaves as reported. They are not independent accuracy, exploit confirmation, or a prediction of how the checks perform on your traffic.
The harness runs selected reference cases through the actual rules engine. It proves those fixtures are processed exactly as reported. It does not prove that ordinary monitoring generally fails, that the rules generalize to independent traffic, or that a match is a confirmed compromise.
Behavior-only compromise that leaves telemetry unchanged. These indicators watch telemetry; an attack that produces no anomalous telemetry produces no indicator. That gap is precisely why the review is human-led.
Nested argument values are inspected recursively after bounded URL decoding, Unicode normalization and common-confusable folding. Encoded traversal, custom argument keys and Base64 secret shapes can reach the analyst without adding one rule per field name.
A preventive control is marked verified only when approved source or configuration evidence, or an authorized negative test, demonstrates its passing condition.
Five selected indicator classes against self-authored sample fixtures and one self-authored benign corpus. It verifies committed outputs, not independent accuracy, exploit confirmation, or customer-environment performance.
# framework/repro_offline.py --tier sample
Aggregate benign FP: 0/4727
| technique | scenario | recall label | hit/total |
|---|---|---|---|
| SAF-T1001 | tool_poisoning | tool_poisoning_html_comment | 3/3 |
| SAF-T1104 | sensitive_abs_read | sensitive_abs_read | 2/3 |
| SAF-T1105 | path_traversal | path_traversal | 2/3 |
| SAF-T1201 | rug_pull | rug_pull_baseline_drift | 3/3 |
| SAF-T1502 | credential_exfil_via_read | read_hop | 2/2 |
| SAF-T1502 | credential_exfil_via_read | exfil_hop | 2/2 |
- `tool_poisoning_html_comment` sample recall: expected [3, 3], got (3, 3) -- MATCH
- `sensitive_abs_read` sample recall: expected [2, 3], got (2, 3) -- MATCH
- `path_traversal` sample recall: expected [2, 3], got (2, 3) -- MATCH
- `rug_pull_baseline_drift` sample recall: expected [3, 3], got (3, 3) -- MATCH
- `read_hop` sample recall: expected [2, 2], got (2, 2) -- MATCH
- `exfil_hop` sample recall: expected [2, 2], got (2, 2) -- MATCH
- aggregate FP: expected [0, 4727], got (0, 4727) -- MATCH
PASSED -- reproduces the committed sample-level numbers
Path traversal is honestly 2/3, not rounded up: one fixture correctly defers to the credential-read rule by design. The sample column is never the full-corpus column.
Your engineers can run the lab locally and compare the committed sample with the real rules engine. The live path must pass its readiness, rule-sync, and result-count checks on the environment where it runs; an incomplete run is a failure, not a clean result.
Read the review methodEvery finding separates what a person confirmed from what a tool merely flagged.
Automated indicator: a named argument matched a secret-shaped pattern in the capture. No causal chain to exfiltration is proven by the indicator alone.
Analyst note: traced the argument to its source; it was a test token in a fixture, not a live credential. Downgraded pending confirmation of the production configuration.
Remediation if confirmed: keep secrets out of tool arguments; pass a reference and resolve server-side; add egress filtering as a compensating control.
Values and identifiers are fabricated for illustration.