[BasilZafar11]

PI079 had no independent literal-key specimens behind its length cutoff or severity. This adds sourced command excerpts and runnable threshold measurements, and changes the finding's remediation to check explicit user authorization instead of unconditionally removing a legitimate SSH installation command.

Closes #180.

Evidence and decision

• A SANS DShield honeypot command matches PI079. This is an independently captured hostile command, not evidence of a prompt-injection incident.
• A GeckoAdmin SSH setup example with a complete Ed25519 public key also matches. An Extract SFTP setup example with an elided key does not.
• The sensitivity test runs six candidate minima through the production Scanner. Raising the minimum above 64 characters after the prefix suppresses the benign Ed25519 example by excluding complete keys of that size, regardless of intent. The shipped regex and MEDIUM grade are retained. This sample does not establish an optimal cutoff or population error rate.
• Corrects the cutoff description: four literal AAAA characters plus the {40,} quantifier means 44 total base64 characters, excluding padding. Synthetic boundary tests are explicitly separate from independent evidence.

Full provenance, measured outcomes, and limitations are in docs/PI079-EVIDENCE.md. The new excerpts live outside the zero-finding clean corpus because authorized and unauthorized key installation can have identical syntax. Existing clean specimens and recall pins are unchanged.

Validation

• cargo test --locked --test pi079_evidence_test: all 3 tests pass.
• cargo clippy --all-targets --locked -- -D warnings and cargo fmt --all -- --check: pass.
• cargo test --locked --no-fail-fast -- --skip findings_name_the_repository_path_not_the_staging_copy: 468 passed, 0 failed, 1 filtered out. The excluded pre-existing Windows-only path assertion expects docs/CLAUDE.md but receives .\docs\CLAUDE.md; neither that test nor its implementation is changed. The final evidence tests were rerun after adding a fixture-count guard, and all 3 pass.
• Release build and whole-repository baseline scan: pass. Catalogue regenerated. Baseline regeneration adds only the two PI079 fixture matches, with no new documentation findings. Generated Windows baseline paths are normalized to the repository's POSIX convention; fingerprints are unchanged.

Started directly from freshly fetched upstream main edec71c; the fork's main matched that commit. No engine/schema/output-contract changes or dependencies, so no ADR is required. No production unwraps, debug output, or catch-all pattern matches added.

[hermanngeorge15]

Reviewed: no detection change (regex and MEDIUM grade untouched); the {40,}-after-AAAA arithmetic and the corrected Ed25519 comment check out; payload text stays in tests/fixtures; the evidence tests guard their own assumptions (one {40,} occurrence, three specimens). After updating onto main with #197, the catalogue matches a fresh regeneration and the whole-repo baselined scan is 0 findings. Thanks — this turns #180's open question into a measurement.