feat(aegis): tolerance learns version churn; XProtect staleness learns the updater heartbeat - #7
Merged
Conversation
…s the updater heartbeat Finishing the two residuals from the acquired-tolerance ship (#6): - Version churn is path churn: a vendor's versioned install dir renames on every release (claude-code-2.1.226 -> .228, runner bin.2.336.0), so the same reviewed binary presented a "new" beacon identity per update. Dotted version segments are now normalized — ONLY inside path-like ':'-fields; an ip/port/trust verdict is its own field with no '/', so endpoints stay literal and a new endpoint always alerts. net-beacon joins the tolerance category allowlist. Measured on the live verdict history: 4 -> 6 tolerized identities (both recurring Claude-extension endpoints, 3 human verdicts each across three version dirs). - XProtect staleness conflated two opposite diagnoses: "update path broken (go fix Software Update/MDM)" vs "updater alive, Apple has not shipped (nothing to fix locally)". The `xprotect version` Installed stamp is the updater's own heartbeat and separates them: corpus old + heartbeat fresh (<=14d) now reports INFO with the honest no-action detail instead of the misleading MEDIUM. Live case that exposed it: corpus v5355 is 75 days old but was (re)installed the same morning the finding said to check Software Update. Suite: 879 passed, 4 skipped (platform-scoped). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finishing the two residuals from #6.
Tolerance learns version churn
A vendor's versioned install dir renames on every release (
claude-code-2.1.226→.228, runnerbin.2.336.0), so the same reviewed binary presented a "new" beacon identity per update and re-alerted anyway. Dotted version segments are now normalized to#— only inside path-like:-fields. An ip, port, or trust verdict is its own:-field with no/, so endpoints stay literal: a new ip:port always alerts.net-beaconjoins the tolerance category allowlist.This is the same precedent the hash-strip already set (same path, same trust class, new content), applied to the path's version component.
risk:-kind incidents remain never-tolerated and the process sensor still grades signatures independently.Measured on the live verdict history: 4 → 6 tolerized identities — both recurring Claude-extension endpoints (3 human verdicts each, across three version directories).
XProtect staleness learns the updater heartbeat
Corpus age alone conflated two opposite diagnoses: "update path broken — go fix Software Update/MDM" vs "updater alive, Apple has not shipped — nothing to fix locally". The
xprotect versionInstalledstamp is the update mechanism's own heartbeat and separates them: corpus older than the threshold but heartbeat fresh (≤14d) now reports INFO with the honest no-action detail instead of the misleading MEDIUM.The live case that exposed it: corpus v5355 is 75 days old, but the OS updater (re)installed it the same morning the finding told the operator to check Software Update.
Verification
🤖 Generated with Claude Code