From 33646eb96cd9615931695df39173267c8ba979d9 Mon Sep 17 00:00:00 2001
From: "andre.bolinhas" <andre.bolinhas@articatech.com>
Date: Tue, 3 Nov 2026 01:03:37 +0000
Subject: [PATCH] Prove the CVE channel end to end, with a rule that cannot
 match real traffic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The channel shipped in engine 3.0.47 and has never carried anything: every
agent fetches cve.json hourly and skips it unread, because the build stamp has
not moved since 23/10. A mechanism that has never delivered a payload is not
known to work, and the day to find that out is not the day after a disclosure.

So: one rule for a path carrying a random nonce. No real client requests it,
nothing legitimate can match it, and it is anchored at both ends — checked
against the path itself and against three near misses before publishing.

This is deliberately NOT the five PHP patterns from engine 3.2.0. Every agent
in the fleet is already on 3.2.0, so those rules would add no protection, and
this document says why that matters: a feed rule and a compiled rule both add
to the same anomaly score, so one attack would be scored twice and reported as
two rules. Verified rather than taken on trust - rules.go accumulates in
eighteen places and ruleset.go:1354 adds to the same total.

Withdrawn as soon as it is confirmed enforced, which also exercises the
withdrawal path this channel treats as a first-class operation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
---
 cve.json | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/cve.json b/cve.json
index 3780350..f5d4623 100644
--- a/cve.json
+++ b/cve.json
@@ -1,4 +1,29 @@
 {
-  "build_datetime": "2026-10-23T12:33:23Z",
-  "rulesets": []
+  "build_datetime": "2026-11-03T01:02:04Z",
+  "rulesets": [
+    {
+      "id": "edgeguard-cve",
+      "name": "EdgeGuard CVE Virtual Patches",
+      "version": "1",
+      "source": "edgeguard-cve",
+      "description": "Virtual patches for named vulnerabilities",
+      "enabled": true,
+      "priority": 1,
+      "rules": [
+        {
+          "id": "CHANNEL-SELFTEST-10503d3d40e334c7",
+          "name": "CVE channel self-test (temporary; withdraw after verifying)",
+          "pattern": "^\\/edgeguard-channel-selftest-10503d3d40e334c7$",
+          "targets": [
+            "uri"
+          ],
+          "action": "block",
+          "severity": "critical",
+          "category": "cve",
+          "enabled": true,
+          "description": "Proves this channel reaches an edge and is enforced. The path carries a random nonce, so no real client requests it and nothing legitimate can match. Withdrawn as soon as it is confirmed."
+        }
+      ]
+    }
+  ]
 }