Correlation¶

G rules take the set of recent analyses as their input. D walks one package's dependency graph; T reads one package's history; G asks what several packages share.

This is what makes a campaign visible: a "new CDN" is plausible once and damning when five unrelated packages add it in the same week. G finds the join, names the members, and fires one alert instead of N.

G runs at cycle end in the full-AUR sweep, never on a single review; the input is collective and a single package cannot supply it.

This is a reference page. For how weight and scope work, see Rule System.

Reading a G finding¶

• The evidence names the members (package names), never the shared content's meaning; for a shared literal it names the class and length, not the literal.
• One firing covers the whole cluster, so the alert count is the campaign count.

Rules on this page¶

G001: Shared Gained Host¶

• Target: programmatic (cycle records)
• Severity: HIGH (weight 25)
• Category: correlation
• Condition: The same gained canonical host appears in [thresholds] g_host.min_packages (default 5) distinct packages within the cycle window.

atomic-arch's signature: a new CDN added by many unrelated packages at once.

G002: Shared Added Literal¶

• Target: programmatic (cycle records)
• Severity: HIGH (weight 25)
• Category: correlation
• Condition: An identical added literal above [thresholds] g_blob.min_length (default 256) characters appears in g_blob.min_packages (default 2) unrelated packages in the window.

The literal's content is never printed - only its length and the members.

G003: Coordinated Adoption¶

• Target: programmatic (cycle records)
• Severity: MEDIUM (weight 15)
• Category: correlation
• Condition: One maintainer key adopts at least [thresholds] g_adopt.min_members (default 3) packages in the window.

Adoption is the temporal engine's own predicate - H044 (ownership transition) or H086 (orphan-to-maintained) - recorded per package, not a bare maintainer-change. The finding's predicates names which T instance the group joined on; H074 (mass adoption) is the cross-package aggregation this rule performs.

G004: Shared Upstream Dependency¶

• Target: programmatic (cycle records)
• Severity: HIGH (weight 25)
• Category: correlation
• Condition: The same upstream dependency (and host), added to a committed manifest, appears in at least [thresholds] g_dep.min_packages (default 2) packages in the window.

The committed-manifest counterpart to G001: a dependency name and remote host that many packages gain in the same window is the same-new-upstream-dependency campaign shape. It reads the recorded upstream_dep_additions view (the U-series dependency additions); the engine ships and is unit-tested, and the corpus feed that fills the view is the same pending work G002's literal feed is.