Add benign and malicious corpus with false-positive and redaction policy #29

Goal

Add a benign and malicious corpus and data fixtures that measure false positives and enforce secret redaction with a paths and confidence policy.

Observations

• Detection quality needs measurement, not assertion.
• Findings may reference sensitive content and must be redacted.
• Paths and confidence need a documented policy.

Decision gate

Approve corpus composition and the redaction and confidence policy before wiring assertions.

Acceptance criteria

• Benign and malicious corpora exist with expected outcomes.
• False-positive rate is measured and recorded per rule.
• Redaction hides secret-like content while keeping paths and confidence.

Verification

• Corpus run -> recorded true positives, false positives, and misses per rule.
• Redaction check -> secret-like values absent from reports, paths retained.

Release checkpoint

Remaining risk: a corpus is a sample, not proof of completeness. No unconditional LLM verdicts.

Tracking

Roadmap item: B06-02. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Build a deterministic bounded scanner for contextual repository risk #28 (B06-01).