Rule Nature¶

Every rule category on the Rule System tab answers both how its rules detect and why the category exists at all. This tab is the second half: for each category, where the idea came from and what a finding means once you have one.

The series page reads nature the other way, by mechanism (R, H, C, and the rest). The two cross-cut: an integrity finding is an integrity finding whichever series produced it, and the interpretation below is the same across mechanisms.

Categories¶

• Fetch and Execution; the classic fetch-then-run shape, the security core
• Obfuscation; making the recipe unreadable, so the reviewer cannot read it
• Deception and Anti-Analysis; tricks aimed at the reviewer, not the compiler
• Install and Persistence; arranging to run again after the build
• Staging and Reconnaissance; reading the target before acting
• Integrity and Verification; defeating the checksum promise
• Naming and Dependencies; name-clones and transitive trust
• Maintainer and Metadata; the account and recipe signals around the code
• Temporal Context; timing as evidence
• Composition; chains that are only dangerous together
• Count-Based; thresholds over matched evidence
• Corpus Behavioral; deviation from what the ecosystem normally does
• Crossfire; a package attacking its own build environment
• Sabotage; tampering with the code that gets built
• Unverifiable; claims TrustSight cannot check
• Meta and Confluence; the run's own health, and agreement across families
• Entropy; randomness as a build-output signal
• Correlation; the immune-import model of campaigns (the G-series)
• Artifact; what actually lands in the package
• Indicators; concrete observables from signed data
• Upstream Manifests; declared source against what upstream published
• Upstream Release Integrity; a declared upstream's build automation and unauditable source transports

See also¶

• Rule System tab; the catalog and mechanics
• Rule Nature by series; the mechanism axis
• Assurance Layers; how the categories combine into a verdict