{ "pack_id": "grep-string-and-format-rules", "title": "Grep, string and format rules", "version": "0.1.0", "summary": "A collection of nouns and verbs for Aho-Corasick literal scanning, portable grep rules, Unicode and entropy security checks and strict JSON and copy formatting.", "dependencies": [ "configuration-grids-and-bounds", "checks-of-checks", "security-review", "wiring-and-conformance-checks" ], "boundaries": [ "All regex, literal, Unicode, SHA-256 name-hash and Shannon-entropy scans run offline over local text buffers and never contact external services.", "Matched secrets, high-entropy tokens and hashed blocklist hits are masked in diagnostic reports so cleartext credentials never leak into receipts.", "Every codepoint bound, entropy cutoff, safe-integer bit-width and caption line limit resolves from default_grid_spec.json and passes ZeroHardcodedValuesAstGate.", "Importing the pack writes nothing, enqueues nothing and installs no code." ], "nouns": [ { "slug": "pack", "category": "noun.skill_pack", "role": "pack", "title": "A collection of nouns and verbs for Aho-Corasick literal scanning, portable grep rules, Unicode and entropy security checks and strict JSON and copy formatting", "value": { "lets_workers": "Scan multi-pattern literal catalogs in single-pass O(|text| + matches) time with AhoCorasickAutomaton, enforce ECMA-262 regex portability and sentence-level negation rules with PortableGrepRuleRunner, catch Trojan Source bidi overrides, Unicode Tag ASCII smuggling, SHA-256 hashed name leaks and mixed-class high-entropy secrets with UnicodeAndEntropySecurityScanner and enforce canonical duplicate-free JSON and clause-balanced captions with StrictJsonAndCopyFormatter.", "flow": [ { "verb": { "$verb": "grep-string-and-format-rules.scan-literals-and-portable-grep-rules" }, "when": "Run single-pass Aho-Corasick multi-pattern scans, validate ECMA-262 regex portability, scrub local home paths and check sentence-level outbound negation, secret prefixes, accusatory copy and placeholder stamps." }, { "verb": { "$verb": "grep-string-and-format-rules.audit-unicode-smuggling-and-entropy" }, "when": "Verify NFC normalization, decode hidden Unicode Tag block payloads, flag Trojan Source bidi/zero-width/variation-selector characters, check SHA-256 name-hash blocklists and mask high-entropy tokens while exempting lowercase hex digests." }, { "verb": { "$verb": "grep-string-and-format-rules.verify-strict-json-copy-and-ast-gate" }, "when": "Independently verify strict duplicate-free canonical JSON, reject raw HTML entities and em-dashes, wrap clause-balanced two-line captions and confirm ZeroHardcodedValuesAstGate conformance." } ], "guardrails": [ { "$pin": "guardrail.masked-diagnostics-and-hex-pin-exemption" }, { "$pin": "guardrail.zero-inline-rule-magic-literals" } ], "tool": { "$pin": "tool.rule-engine" }, "worked_example": "Synthetic multi-pattern, portable regex, Unicode Tag smuggling, SHA-256 name-hash, Shannon-entropy and strict JSON/caption bundle recomputed in test_rule_engine.py: matches whole-word Aho-Corasick literals, rejects lookbehind regex syntax, scrubs /Users/demo_worker/ paths, decodes hidden Tag payload 'hidden', exempts a 64-char SHA-256 digest while masking a 4-class high-entropy token, rejects duplicate JSON keys and wraps a clause-balanced two-line caption." }, "relations": [ [ "requires_noun", "guardrail.masked-diagnostics-and-hex-pin-exemption" ], [ "requires_noun", "guardrail.zero-inline-rule-magic-literals" ], [ "requires_noun", "spec.portable-grep-unicode-and-format-grid" ], [ "requires_noun", "rules.negation-entropy-and-caption-wrapping" ], [ "requires_noun", "tool.rule-engine" ], [ "requires_noun", "template.rule-engine-receipt" ] ] }, { "slug": "guardrail.masked-diagnostics-and-hex-pin-exemption", "category": "noun.skill_pack", "role": "guardrail", "title": "Guardrail: security diagnostics mask matched secrets and exempt 32..64-char lowercase hex content digests", "category_reason": "Prevents diagnostic reports from echoing cleartext secrets while avoiding false-positive blocks on SHA-256 pins.", "value": { "rule": "Never emit full cleartext tokens for secret-prefix, high-entropy or SHA-256 name-hash hits, and always exempt 32..64-character lowercase hexadecimal digests from Shannon-entropy masking.", "how_it_is_checked": "PortableGrepRuleRunner and UnicodeAndEntropySecurityScanner truncate matched tokens to configured prefix lengths and unit tests verify 0 false positives on 32-char MD5 and 64-char SHA-256 digests." } }, { "slug": "guardrail.zero-inline-rule-magic-literals", "category": "noun.skill_pack", "role": "guardrail", "title": "Guardrail: codepoint ranges, entropy thresholds, safe-integer bounds and caption limits forbid inline magic numbers", "category_reason": "Forces every scanner range and formatting threshold into externalized configuration grids.", "value": { "rule": "Operational Python functions and classes in rule_engine may only inline canonical mathematical identities (-1, 0, 1, -1.0, 0.0, 1.0); all Unicode ranges, bit-widths, entropy cutoffs and line-length bounds resolve from default_grid_spec.json.", "how_it_is_checked": "ZeroHardcodedValuesAstGate.scan_paths statically scans every module in rule_engine during make check." } }, { "slug": "spec.portable-grep-unicode-and-format-grid", "category": "noun.benchmark_suite", "role": "spec", "title": "Specification: Aho-Corasick, ECMA-262 regex portability, Unicode security ranges, entropy bounds and strict JSON invariants", "category_reason": "Defines deterministic multi-pattern scanning, Unicode codepoint blocks, IEEE-754 integer bounds and caption rules.", "value": { "components": [ "AhoCorasickAutomaton", "PortableGrepRuleRunner", "UnicodeAndEntropySecurityScanner", "StrictJsonAndCopyFormatter" ], "unicode_tag_block_decimal": [ 917504, 917631 ], "exempt_lowercase_hex_lengths": [ 32, 64 ], "ieee754_safe_int_bits": 53 } }, { "slug": "rules.negation-entropy-and-caption-wrapping", "category": "noun.reflex_procedure", "role": "rules", "title": "Sentence-level outbound negation, mixed-class Shannon entropy and orphan-free clause-balanced caption procedure", "category_reason": "Zero-model deterministic text hygiene and formatting procedure.", "value": { "negation_exemption_rule": "Split prose on sentence terminators and allow outbound effect words only when the same sentence carries an explicit negation cue.", "caption_balance_rule": "Enforce minimum two words per wrapped line, forbid line breaks immediately after unpunctuated prepositions/articles/conjunctions and reward clause-punctuation splits.", "model_calls": 0 } }, { "slug": "tool.rule-engine", "category": "noun.code_node", "role": "tool_card", "title": "Tool card: standard-library Aho-Corasick automaton, portable grep runner, Unicode/entropy scanner and strict formatter", "category_reason": "Tested Python 3.10+ standard-library package pinned by path and SHA-256.", "value": { "name": "grep, string and format rules", "code": { "$code": "grep-string-and-format-rules" }, "runtime": "Python 3.10 or later, standard library only.", "commands": [ "python -m rule_engine --bundle BUNDLE.json" ], "does": [ "Runs single-pass O(|text| + matches) AhoCorasickAutomaton scans and PortableGrepRuleRunner checks for ECMA-262 portability, outbound negation, secret prefixes, home paths, accusatory copy and placeholder stamps.", "Detects non-NFC text, Trojan Source bidi overrides, zero-width/variation-selector characters, Unicode Tag ASCII smuggling, SHA-256 hashed blocklist names and high-entropy secrets.", "Enforces duplicate-key/NaN/unsafe-int rejection in JSON, HTML entity and em-dash checks and clause-balanced two-line caption wrapping verified by ZeroHardcodedValuesAstGate." ], "does_not": [ "Echo cleartext secrets in diagnostics, flag 32..64-char lowercase hex SHA-256 pins or perform network calls." ], "code_license": "MIT" }, "relations": [ [ "verifies", "spec.portable-grep-unicode-and-format-grid" ] ] }, { "slug": "template.rule-engine-receipt", "category": "noun.scene_recipe", "role": "template", "title": "Template: Aho-Corasick, portable grep, Unicode/entropy security and strict JSON/caption receipt", "value": { "describes": "a deterministic receipt of multi-pattern literal matches, ECMA-262 regex portability verdicts, secret/path/stamp counts, decoded Tag smuggling payloads, SHA-256/entropy hits and canonical JSON/caption outputs", "schema": { "type": "object", "additionalProperties": false, "required": [ "aho_matched_patterns", "portable_regex_passed", "non_portable_regex_rejected", "outbound_violation_count", "secret_prefix_hit_count", "scrubbed_home_paths", "accusatory_hit_count", "visible_stamp_hit_count", "trojan_bidi_hit_count", "decoded_tag_payload", "blocked_name_hash_hits", "high_entropy_hit_count", "exempted_hex_digest_count", "clean_json_canonical", "duplicate_json_rejected", "html_entity_leaks", "wrapped_caption_lines" ], "properties": { "aho_matched_patterns": { "type": "array", "items": { "type": "string" } }, "portable_regex_passed": { "type": "boolean" }, "non_portable_regex_rejected": { "type": "boolean" }, "outbound_violation_count": { "type": "integer", "minimum": 0 }, "secret_prefix_hit_count": { "type": "integer", "minimum": 0 }, "scrubbed_home_paths": { "type": "integer", "minimum": 0 }, "accusatory_hit_count": { "type": "integer", "minimum": 0 }, "visible_stamp_hit_count": { "type": "integer", "minimum": 0 }, "trojan_bidi_hit_count": { "type": "integer", "minimum": 0 }, "decoded_tag_payload": { "type": "string" }, "blocked_name_hash_hits": { "type": "integer", "minimum": 0 }, "high_entropy_hit_count": { "type": "integer", "minimum": 0 }, "exempted_hex_digest_count": { "type": "integer", "minimum": 0 }, "clean_json_canonical": { "type": "string", "minLength": 2 }, "duplicate_json_rejected": { "type": "boolean" }, "html_entity_leaks": { "type": "array", "items": { "type": "string" } }, "wrapped_caption_lines": { "type": "array", "items": { "type": "string" } } } }, "example": { "aho_matched_patterns": [ "verify_gate", "distinct_reviewer" ], "portable_regex_passed": true, "non_portable_regex_rejected": true, "outbound_violation_count": 0, "secret_prefix_hit_count": 1, "scrubbed_home_paths": 1, "accusatory_hit_count": 1, "visible_stamp_hit_count": 1, "trojan_bidi_hit_count": 1, "decoded_tag_payload": "hidden", "blocked_name_hash_hits": 1, "high_entropy_hit_count": 1, "exempted_hex_digest_count": 1, "clean_json_canonical": "{\"alpha\":[true,false],\"zeta\":1}", "duplicate_json_rejected": true, "html_entity_leaks": [ "—", "→" ], "wrapped_caption_lines": [ "Deterministic rules block bidi tricks,", "and guard every clean summary" ] } } }, { "slug": "example.rule-engine-bundle", "category": "noun.eval_run", "role": "example", "synthetic": true, "title": "Worked example input: synthetic Aho-Corasick, portable regex, Unicode Tag, SHA-256 name, entropy and formatter samples", "category_reason": "Synthetic fixture recomputed by test_rule_engine.py.", "value": { "aho_patterns": [ "verify_gate", "probe_source", "distinct_reviewer" ], "aho_text": "Run verify_gate before distinct_reviewer signoff; skip verify_gate_extra partial word.", "portable_pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$", "non_portable_pattern": "(?<=prefix_)[a-z]+", "grep_audit_sample": "Workers never send external alerts. Sample hmk_SyntheticKeyTest0001 in /Users/demo_worker/run.json shows fraudulent wording and coming soon text.", "unicode_probe_prefix": "status_check", "unicode_probe_codepoints": [ 8238, 917608, 917609, 917604, 917604, 917605, 917614 ], "name_hash_probe_text": "Reference to redacted_codename_alpha inside summary.", "entropy_probe_text": "Pin 5ad1e0970bfbf79b3906a248df23a0f6d0be4da8299efd256ac51019a6df290e vs Xz9#mQ4!vR7@kL2$pW8^nB5&", "clean_json_sample": "{\"zeta\": 1, \"alpha\": [true, false]}", "duplicate_key_json_sample": "{\"id\": 1, \"id\": 2}", "html_entity_copy_sample": "Verified receipt — deterministic check → ready", "caption_sample": "Deterministic rules block bidi tricks, and guard every clean summary", "shows": "Synthetic multi-pattern, portable regex, Unicode/entropy and strict formatter audit bundle.", "source": "Synthetic. Written for this pack." } }, { "slug": "example.rule-engine-receipt", "category": "noun.eval_run", "role": "example", "synthetic": true, "title": "Worked example output: recomputed Aho-Corasick, portable grep, Unicode/entropy and formatter receipt", "category_reason": "Synthetic receipt verified by test_rule_engine.py.", "value": { "conforms_to": { "$pin": "template.rule-engine-receipt" }, "instance": { "aho_matched_patterns": [ "verify_gate", "distinct_reviewer" ], "portable_regex_passed": true, "non_portable_regex_rejected": true, "outbound_violation_count": 0, "secret_prefix_hit_count": 1, "scrubbed_home_paths": 1, "accusatory_hit_count": 1, "visible_stamp_hit_count": 1, "trojan_bidi_hit_count": 1, "decoded_tag_payload": "hidden", "blocked_name_hash_hits": 1, "high_entropy_hit_count": 1, "exempted_hex_digest_count": 1, "clean_json_canonical": "{\"alpha\":[true,false],\"zeta\":1}", "duplicate_json_rejected": true, "html_entity_leaks": [ "—", "→" ], "wrapped_caption_lines": [ "Deterministic rules block bidi tricks,", "and guard every clean summary" ] }, "shows": "Recomputes whole-word Aho-Corasick matches, ECMA-262 portability check, negated outbound exemption, masked secret/path/name/entropy detections, Tag payload decoding, strict JSON canonicalization and balanced caption lines.", "source": "Synthetic. Recomputed directly from example.rule-engine-bundle." }, "relations": [ [ "derives_from", "example.rule-engine-bundle" ], [ "verifies", "template.rule-engine-receipt" ] ] } ], "verbs": [ { "slug": "scan-literals-and-portable-grep-rules", "kind": "verb.probe_source", "title": "Run single-pass Aho-Corasick literal scans and ECMA-262 portable grep rule checks", "claimant": "agent", "model_use": "none", "summary": "Compile AhoCorasickAutomaton failure and output links for single-pass literal scanning, validate ECMA-262 regex portability, scrub local home paths, refuse unnegated outbound effect verbs without flagging negated sentences and block placeholder UI stamps.", "outcome": "Deterministic literal, regex portability, path-scrub and copy-hygiene report.", "ready_outcome": "grep_rules_scanned", "pinned": [ "spec.portable-grep-unicode-and-format-grid", "rules.negation-entropy-and-caption-wrapping", "guardrail.masked-diagnostics-and-hex-pin-exemption", "tool.rule-engine" ], "slots": [ { "name": "text_audit_bundle", "category": "noun.eval_run", "description": "Pin of literal catalogs, regex patterns and candidate text buffers." } ], "produces": [ { "name": "grep_scan_receipt", "template": "template.rule-engine-receipt" } ], "steps": [ "Build AhoCorasickAutomaton tries and failure/output links from grid-configured patterns.", "Validate ECMA-262 regex portability, scrub /home/ and /Users/ paths and mask any secret-prefix hits." ], "acceptance": [ { "id": "portable-and-single-pass-grep", "check": "Lookbehind/backref regexes fail portability, negated sentences pass outbound checks and secret prefixes are masked.", "method": "deterministic" } ] }, { "slug": "audit-unicode-smuggling-and-entropy", "kind": "verb.verify_gate", "title": "Scan text for Trojan Source bidi, Unicode Tag smuggling, SHA-256 name hashes and high-entropy secrets", "claimant": "agent", "model_use": "none", "summary": "Enforce NFC normalization, flag Trojan Source bidi overrides, zero-width and variation-selector characters, decode hidden Unicode Tag block payloads, check SHA-256 name-hash blocklists and mask high-entropy mixed-class tokens while exempting lowercase hex digests.", "outcome": "Unicode smuggling, SHA-256 blocklist and masked Shannon-entropy security report.", "ready_outcome": "unicode_and_entropy_checked", "pinned": [ "spec.portable-grep-unicode-and-format-grid", "guardrail.masked-diagnostics-and-hex-pin-exemption", "tool.rule-engine" ], "slots": [ { "name": "security_text_bundle", "category": "noun.eval_run", "description": "Pin of candidate text and codepoint streams to audit." } ], "produces": [ { "name": "unicode_entropy_receipt", "template": "template.rule-engine-receipt" } ], "steps": [ "Verify NFC normalization and scan configured Trojan bidi, zero-width, variation-selector and Tag codepoint ranges.", "Hash normalized tokens against SHA-256 blocklists and mask mixed-class high-entropy secrets while skipping 32..64-char lowercase hex pins." ], "acceptance": [ { "id": "tag-decode-and-hex-exemption", "check": "Hidden Tag ASCII payloads decode deterministically and 64-char SHA-256 hex pins trigger zero entropy false positives.", "method": "deterministic" } ], "follows": [ "grep-string-and-format-rules.scan-literals-and-portable-grep-rules" ] }, { "slug": "verify-strict-json-copy-and-ast-gate", "kind": "verb.verify_gate", "title": "Independently verify strict JSON canonicalization, clause-balanced captions and AST magic-literal conformance", "claimant": "agent", "model_use": "none", "summary": "Reject duplicate JSON keys, NaN/Infinity constants and integers exceeding IEEE-754 MAX_SAFE_INTEGER, block raw HTML entities and em-dashes, wrap orphan-free clause-balanced captions and verify ZeroHardcodedValuesAstGate passes every operational module.", "outcome": "Independent strict JSON, copy formatting and AST conformance receipt.", "ready_outcome": "json_copy_and_ast_verified", "review": "distinct_reviewer", "pinned": [ "spec.portable-grep-unicode-and-format-grid", "rules.negation-entropy-and-caption-wrapping", "guardrail.zero-inline-rule-magic-literals", "tool.rule-engine", "template.rule-engine-receipt" ], "slots": [ { "name": "formatter_eval_bundle", "category": "noun.eval_run", "description": "Pin of JSON payloads, plain-text copy and caption candidates." } ], "produces": [ { "name": "verified_formatter_receipt", "template": "template.rule-engine-receipt" } ], "steps": [ "Canonicalize JSON with duplicate-key, non-finite and IEEE-754 safe-integer hooks and wrap balanced caption lines.", "Run ZeroHardcodedValuesAstGate across rule_engine modules and confirm zero inline magic numbers." ], "acceptance": [ { "id": "strict-json-caption-and-ast-gate", "check": "Duplicate JSON keys fail closed, wrapped captions avoid 1-word orphans and trailing prepositions and ZeroHardcodedValuesAstGate reports zero violations.", "method": "deterministic" } ], "follows": [ "grep-string-and-format-rules.audit-unicode-smuggling-and-entropy" ] } ] }