feat(sec-core): add ATR rule packs and cut compile time - #2531
Merged
Conversation
haosanzi
requested review from
RemindD,
casparant,
edonyzpc and
kid9
as code owners
August 14, 2026 05:38
github-actions
Bot
added
component:sec-core
![qoderai[bot]](https://avatars.githubusercontent.com/in/1396158?s=60&v=4){kind=small}
There was a problem hiding this comment.
[P1] ATR 规则禁用机制与生成产物之间存在潜在漂移，建议将禁用逻辑完全集中在 disabled.yaml + 转换器测试中，以避免未来 sync_atr 迭代时出现不一致。
[P1] 正则归一化性能门禁目前只覆盖现有内置规则，缺少对未来 pack 的约束，建议在 sync_atr 和 builtin_packs 测试中同时强制 [\s\S]→(?s:.) 归一化以防回退。
[P2] ATR 同步文档的示例命令缺少明确的使用范围和环境约束，建议补充说明该 CLI 仅用于规则 vendoring，不应在生产路径调用，并链接到 agent-sec-core 组件 AGENTS.md 的安全约束。
🤖 Generated by Qoder • View workflow run
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 855600b2cd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Introduce the v2 rule-pack schema (provenance metadata, per-rule test_cases, url/references, single_line), add the sync_atr converter that renders upstream Agent-Threat-Rule content into vendored packs, and vendor the stable ATR prompt-injection, agent-manipulation and context-exfiltration packs with an UPSTREAM.toml audit trail. Chose compile-time embedding over runtime file lookup so the engine ships its rule set with no I/O dependency. Disabled rules are tracked in disabled.yaml with reasons rather than deleted. Signed-off-by: Shirong Hao <shirong@linux.alibaba.com>
Run every rule's embedded test_cases as a regression (true_positives must fire the owning rule, true_negatives must not) across all packs, and add a benign-corpus false-positive gate: 30 real-world benign prompts that must never trigger any rule. These lock rule behaviour so future upstream syncs cannot silently regress detection or introduce false positives. Signed-off-by: Shirong Hao <shirong@linux.alibaba.com>
Document the v2 rule-pack schema, the sync_atr conversion workflow, the UPSTREAM.toml audit format and the field reference in PROMPT_SCANNER.md. Signed-off-by: Shirong Hao <shirong@linux.alibaba.com>
Rewrite the `[\s\S]` idiom to `(?s:.)` before compiling each pattern: a bracketed class spanning all of Unicode forces regex-syntax to case-fold the whole range under case_insensitive (~6 ms/occurrence vs ~1 ms), so rule-set compilation drops roughly 382 ms to 176 ms. Not a bare `.` — every occurrence sits in a single_line: true rule where `.` stops at newlines and detections are lost; tests pin both the rewrite and that trap. Also surface the one-time engine construction cost that scan latency was hiding: split elapsed_ms into engine_init_ms + scan_ms (charged once per scanner instance) and enable dev regex opt-levels so debug builds are usable. Signed-off-by: Shirong Hao <shirong@linux.alibaba.com>
edonyzpc
reviewed
Aug 14, 2026
edonyzpc
requested changes
Aug 14, 2026
sync_atr validated each upstream regex as written, but the engine now rewrites `[\s\S]` to `(?s:.)` before compiling. A pattern like `\[\s\S]` passes raw validation and becomes `\(?s:.)` — an unopened paren that fails at rule-set load and takes the whole pack down. Mirror the rewrite in the validator so it compiles what the engine compiles. The copy is deliberate: a bin is a separate crate target and cannot reach the private helper, so both sides carry tests over the same cases. Signed-off-by: Shirong Hao <shirong@linux.alibaba.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
What changed
Related issue
User / Agent impact
Risk and compatibility
Validation
Documentation and rollback