You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
PI079: the 40-character key-blob minimum is a choice not a measurement; no independent true-positive or false-positive evidence exists #180
PI079 persistence-command-with-payload (MEDIUM) fires on one line carrying a literal SSH public key of a named type that appends it to authorized_keys with a redirect or an append-mode tee. It shipped on its written criterion (fires through the prose pass on a blind-written corpus payload, silent on every clean specimen), with these honest qualifications recorded at ship time:
It adds no recall.PI077 already counts the one payload it reaches, so the pin was byte-identical; and it reaches none of the 12 held-out payloads.
The 40-character minimum on the key blob is a choice, made so the elided form tutorials print (AAAAB3NzaC1yc2E...) stays silent. It is not derived from a measurement.
No independent evidence either way. Zero lines carrying a literal key blob in the 26,407 files of the frozen GATE-03 inputs (so no false positives and no true positives observed), and the only key-blob lines on the author's machine were in that phase's own agent transcripts.
MEDIUM was a judgment call under PATTERNS.md rule 3: a container build line appending a real public key, and an infrastructure runbook adding a named engineer's key, are recallable benign documents with the same line shape. It is one YAML field to flip.
Revisit when: a real document (benign or hostile) trips it, which would turn the threshold and the grade into measurements.
Filed at the close-out of Phase 5 (CAT-03, #35), plan 05-07 Task 2, from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md. Nothing here is fixed in v0.2.0.
Opened #200 addressing #180 with independent hostile and benign specimens, reproducible threshold measurements, and updated remediation guidance. The evidence supports retaining MEDIUM severity; calibration limits are documented. Includes regression tests and a regenerated baseline.
Activity
BasilZafar11 commentedon Oct 22, 2026
Opened #200 addressing #180 with independent hostile and benign specimens, reproducible threshold measurements, and updated remediation guidance. The evidence supports retaining MEDIUM severity; calibration limits are documented. Includes regression tests and a regenerated baseline.
test: measure PI079 key-blob threshold against independent specimens (#…