AndreandClaude Opus 5
6ca0cd5d20
cve.json carries virtual patches: rules written against a named vulnerability, published as data so that every edge node enforces them within the hour instead of waiting for an engine release. Engine 3.0.47 and later fetch it hourly. It starts empty, which is a valid state and says "no virtual patches at the moment" — the engine accepts an empty rulesets list as of 3.0.47, and publishing one is also how the whole channel stands down. Separate from rulesets.json rather than part of it: each has its own build_datetime, so each is applied or skipped on its own, and a mistake in one cannot take out the other. Publishing a patch should not mean republishing a 357KB mirror of the Core Rule Set. CVE-CHANNEL.md documents the format, the param_names target, how severity becomes the anomaly score, and the two mistakes worth avoiding: publishing a rule for a CVE the engine already patches in code (both fire and the scores add), and forgetting that there is no backtest for a patch written in the hours after a disclosure — which is why withdrawal is a first-class operation here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r
5 lines
65 B
JSON
5 lines
65 B
JSON
{
|
|
"build_datetime": "2026-10-22T13:00:00Z",
|
|
"rulesets": []
|
|
}
|