AndreandClaude Opus 5
33646eb96c
The channel shipped in engine 3.0.47 and has never carried anything: every agent fetches cve.json hourly and skips it unread, because the build stamp has not moved since 23/10. A mechanism that has never delivered a payload is not known to work, and the day to find that out is not the day after a disclosure. So: one rule for a path carrying a random nonce. No real client requests it, nothing legitimate can match it, and it is anchored at both ends — checked against the path itself and against three near misses before publishing. This is deliberately NOT the five PHP patterns from engine 3.2.0. Every agent in the fleet is already on 3.2.0, so those rules would add no protection, and this document says why that matters: a feed rule and a compiled rule both add to the same anomaly score, so one attack would be scored twice and reported as two rules. Verified rather than taken on trust - rules.go accumulates in eighteen places and ruleset.go:1354 adds to the same total. Withdrawn as soon as it is confirmed enforced, which also exercises the withdrawal path this channel treats as a first-class operation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r