📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Can you add tests? Positive and negative, so we cover both cases. Thanks!

Review

Approach is reasonable — adding a boundary prefix to reduce FPs on product codes. A few issues:

1. (?:^|[^a-zA-Z0-9]) could be (?:^|\W) — excludes _ which [^a-zA-Z0-9] doesn't. Product codes like SKU_!-1 probably should also not trigger, so \W might be more appropriate. Minor difference but worth considering

2. PL1 rule with very short pattern — !-\d is extremely short. Adding boundary helps but it's still fragile for paranoia level 1

3. No .ra file — should create one per convention, even for simple regex

4. Missing test for start-of-value — needs a test where !-1 is the entire value (no prefix) to ensure detection still works at ^

5. Need more boundary tests — test with space before (foo !-3), with special chars before, to validate the boundary logic covers real attack scenarios

Thanks for the detailed review @fzipi! I've addressed all points:

1. ** → 13:33 up 8 days, 5:52, 2 users, load averages: 2.38 2.73 2.93
   USER TTY FROM LOGIN@ IDLE WHAT
   zoutje console - 06Apr26 8days -
   zoutje s000 - 06Apr26 8days -zsh** — Updated the regex to use 13:33 up 8 days, 5:52, 2 users, load averages: 2.38 2.73 2.93
   USER TTY FROM LOGIN@ IDLE WHAT
   zoutje console - 06Apr26 8days -
   zoutje s000 - 06Apr26 8days -zsh which also excludes as a valid prefix (e.g., won't trigger).

2. ** file** — Added with the assembly pattern and documentation.

3. Test coverage — Expanded from 3 to 7 regression tests:

   • Test 4: Start-of-value ( alone) — should trigger
   • Test 5: Space prefix () — should trigger
   • Test 6: Underscore prefix () — FP test, should NOT trigger
   • Test 7: Special char prefix () — should trigger

4. PL1 fragility concern — Noted. The boundary prefix helps but the pattern remains short. If further FPs surface, we can move the boundary requirement to PL2 as a stricter sibling.

Thanks for the detailed review @fzipi! I've addressed all points:

1. Boundary prefix — Updated the regex to use (?:^|\W) instead of (?:^|[^a-zA-Z0-9]), which also excludes underscore as a valid prefix character (e.g., SKU_!-1 won't trigger).

2. .ra file — Added regex-assembly/932330.ra with the assembly pattern and documentation.

3. Test coverage — Expanded from 3 to 7 regression tests:

   • Test 4: Start-of-value (!-f alone) — should trigger
   • Test 5: Space prefix (foo !-d) — should trigger
   • Test 6: Underscore prefix (SKU_!-1) — FP test, should NOT trigger
   • Test 7: Special char prefix ([!-2) — should trigger

4. PL1 fragility concern — Noted. The boundary prefix helps but the pattern remains short. If further FPs surface, we can adjust.

Fixed the failing regression tests. Tests 4 and 5 used !-f and !-d (letters) but the rule matches !-\d (digits only). Updated to !-5 and !-7. Rebased on latest main.

Quick summary of current state:

• .ra file: ✅ present (regex-assembly/932330.ra)
• Boundary: (?:^|\W) per fzipi review
• Tests: 7 total (4 positive, 3 negative including underscore FP test)
• Quantitative: no new FPs at PL1/10K