Rules Reference¶

TrustSight uses rules to detect structural signals in PKGBUILD diffs. The inventory is the R-series regex rules, the H-series heuristics, sabotage rules S001-S008, crossfire rules X001-X034, integrity-change rules C001-C032, dependency rules D001-D005, temporal rules T001-T003 and T006-T007, correlation rules G001-G010, entropy rules E001-E003, the indicator rule H056, meta rules M001-M006, upstream rules U001-U010, artifact rules A001-A008, declared-practice rules P001-P009 (P004 skipped), and unverifiable rules W001-W012.

Each rule contributes according to its severity weight, match target and scope, except the P and W series and the weight-0 M annotations, which are weight 0 and report rather than score (the U-series is mostly the same shape: U003, a new remote source, U004, a redirected resolver, U007, a federated CI exfil shape, U008, a federated history sweep, and U010, an unauditable source transport, score; the rest are weight 0), and the A and I series, which are reported outside the heuristic score.

This page is the map. The rule system reference explains how the engine works and holds everything that is not an individual rule: the rules.toml field table, the severity weights, the FATAL label mechanism, the measured fire rates, the series taxonomy, and the reserved identifier ranges. Each rule's own definition lives on the page for its category.

Categories¶

A rule's category is the kind of claim it makes. There is exactly one per rule and the set is closed, so every rule has exactly one page. This is not the same axis as the per-rule category field in rules.toml, which names the capability a match touched (network, persistence, obfuscation) and is what H027 counts when it looks for capability density. A rule can be category = "meta" and still be a composition rule.

The taxonomy is defined in src/trustsight/categories.py as RuleCategory, and tests/test_docs.py fails the build if a rule's documentation drifts to the wrong page. The two tables on this page are generated from it by scripts/build_rules_index.py.

Crossfire is the anti-evasion family introduced in the current ruleset. Its 34 rules detect tokenizer defeat and command reconstruction; see crossfire.md for the family boundary and rule descriptions.

Reading a rule entry¶

Each entry states the same facts in the same order:

• Target: resolved (post-variable-expansion command strings), raw_line (the literal diff line), or programmatic (emitted from code in analysis/, because the condition needs more than one line).
• Severity: FATAL, CRITICAL, HIGH, MEDIUM, LOW or INFO, with the weight it contributes. See severity weights.
• Category: the capability field described above, not the page.
• Pattern or Condition: what makes the rule fire. Quoted patterns are checked against the shipped rules.toml on every test run, so a pattern here cannot drift from the one that runs.
• Fire rate, where measured: hits on the current 3,739-diff benign corpus, unless a page explicitly identifies a historical measurement. These are false-positive rates. The full table is in measured fire rates.

Quick reference¶

Every documented rule, with the page that defines it. The identifier space is deliberately non-contiguous; see reserved identifiers.

Weight-0 declared-practice findings (P001-P009, P004 skipped) are not detections and have no category. They are documented in the system reference.