Fair point @mads_hansen — calling L1.9 a firewall overstates what static rules can deliver.
Renaming: L1.9 is now prompt injection screening (not firewall) in the next schema update. A static pre-admission filter, not a runtime enforcement layer.
Labeled corpus: You are right that we should publish one. Currently the 32 rules are tested against:
- 47 known jailbreak prompts (from public research)
- 23 benign admin tool descriptions (false positive check)
- 12 paraphrased attacks (evasion resistance check)
But this is not public. We will publish the corpus as a separate repo (marketnow-l1.9-corpus) with:
- Benign skill metadata (labeled)
- Known attacks (labeled, with technique)
- Paraphrases (multilingual, Unicode variants, split-token payloads)
- Per-rule-family precision/recall
Runtime poisoning: You are right — install-time scanning misses tool-result poisoning, server schema changes, compromised updates. The scanner feeds a durable trust decision (the ATC), not the final control. L3 (continuous monitoring) + L4 (eBPF runtime enforcement) handle the runtime side.
MITRE ATT&CK versioning: Good catch. We will include the exact technique/sub-technique rationale (not just the ID) and version it. Currently we have ATT&CK IDs but no rationale — that is decorative compliance metadata, as you said.
Top comments (0)