[stacknil]

Problem

Malformed address tokens could become normalized authentication evidence; usernames containing from could lose evidence; sudo command/PWD values could be mistaken for authentication metadata or a COMMAND audit field. Invalid UTF-8 also produced invalid JSON, and Windows text output changed embedded CSV CRLF bytes.

Invariant

Validate the source actually emitted by a handler. Treat opaque values as data; only independent sudo audit fields establish command evidence. Preserve supported authentication classification, default signal eligibility, rule thresholds and evidence references.

Design decision

Tighten address and field boundaries and preserve JSON validity. Open CSV outputs in binary mode to retain field bytes. Add authored semantic expectations, an independent exhaustive small-window detector model, negative controls and structured pipeline fuzzing. Existing parser smoke remains; CI adds only a deterministic 2,000-run pipeline smoke.

Threat/failure model

Synthetic malformed/truncated inputs, ambiguous markers, byte encodings, timestamp/window boundaries and corrupted report observations. This is offline log qualification, not an incident-causality or maliciousness claim.

Rejected alternatives

Scanning all message text for metadata confuses opaque values. Using production output as its own oracle cannot establish semantics. Changing detector rules or replacing goldens would hide compatibility failures.

Compatibility

No detector implementation, default eligibility, threshold, schema version, timestamp implementation or golden changes. Corrected malformed/opaque inputs can change event counts. Bare :: remains excluded. JSON preserves valid UTF-8 and represents malformed bytes as \u00XX; this is not a byte-reversible encoding. CSV columns, quoting and formula neutralization are unchanged; Windows CSV record separators become LF and embedded CR/LF bytes are preserved. Markdown/JSON file modes remain unchanged.

Validation

Local GCC 13.3 Release/WX, Clang 18.1.3 ASan/UBSan and MSVC 19.51 Release/WX: CTest 11/11 each, including existing CLI/report contracts and unchanged goldens. Permanent sudo COMMAND-boundary regression failed before correction; three repeated PWD-marker lines now yield zero events/findings and three warnings. Eight semantic corruption controls and 273 report cases/819 artifact controls passed; extended report checks ran on both Windows and Linux sanitizer builds. Independent read-only review included execution of semantic and report checks.

Extended fuzz execution is local evidence, not hosted CI: parser 1,092,204 inputs/62s; timestamp-day 14,875,968/61s; pipeline 131,105/62s. No detected sanitizer failure. Timed counters belong to the earlier checkpoint documented in the qualification report; later changes were validated through rebuilds, CTest, corpus replay and bounded smoke. These results do not prove complete memory safety. No coverage-guided report-fuzzer claim.

Matched local Release measurements used six 3,000-line workloads, three trials/build. Distinct subjects were corrected to documentation-reserved IPv6 addresses while preserving 3,000 unique subjects; rerun median baseline/candidate wall time was 0.043066/0.041555 seconds, with identical event/warning/finding counts. Other workload medians were approximately 0.04–0.36 seconds. These short filesystem-inclusive observations are not performance-equivalence or throughput claims.

See qualification evidence and reproduction. Private raw logs remain local. Hosted CI results will be evaluated separately on the PR head.

Rollback

Revert this contribution without migrating stored data or changing detector configuration.