content-quality P0+P1: strip LLM enrichment tail + integrity leaks (61/61 pass) - #1
Draft
zepedara wants to merge 1 commit into
Draft
content-quality P0+P1: strip LLM enrichment tail + integrity leaks (61/61 pass)#1zepedara wants to merge 1 commit into
zepedara wants to merge 1 commit into
Conversation
…1/61 pass) Acts on the findings in docs/CONTENT_QUALITY_AUDIT.md. Removes the machine- generated "enrichment" the audit found to be the source of nearly every content defect, while preserving all hand-written module cores and the 5 verified Detection-validation blocks. P0 (integrity, public repo): - remove 9 leaked LLM planning-scratchpad blocks from shipped READMEs (02,07,08,10,23,40,45,53,55) - remove the ANTHROPIC refusal-test canary YARA rule (42) - strip every module's <!-- cyberlab-enriched --> markers + trailing bare-URL dumps - rewrite 23-plaso guided walkthrough (was 100% leaked scratchpad) and reground its answer key to the shipped bodyfile (earliest crtime Tue Nov 14 2023 22:13:20 /etc/passwd) - fix leaked meta-reasoning (07) and malformed Sources links (09, 31) P1 (de-bloat): - delete the generated enrichment tail (Essential Commands & Features / Threat Hunting / Detection Signatures / Adversary Emulation / Common Pitfalls / Real-World Case Study) under '## MITRE ATT&CK & DFIR phase' across all 61 modules - ~11,000 lines removed (~40% of the lab); the fabricated CLI flags, mislabeled ATT&CK IDs, and duplicated blocks are removed with it - PRESERVE the 5 hand-authored, artifact-grounded Detection-validation blocks (21,34,47,50,58) and 54's accurate scdbg flag table Contract validator: 61/61 pass, mean 1.0000, INDEX in sync. Deferred (tracked in the report): P2 real per-module artifacts + answer-key regrounding; P3 the 14 in-core enrichment subsections in 6 modules (04,09,35,51,54,61) and module consolidation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RnkkeCESM5VSNobfg2MdkJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Executes P0 + P1 of the content-quality audit (
docs/CONTENT_QUALITY_AUDIT.md, added in this PR). The audit read all 61 modules and found the core teaching is solid but the machine-generated "enrichment" tail (40% of all content) is the source of nearly every defect — fabricated CLI flags, mislabeled ATT&CK IDs, duplicated blocks, and leaked generator scaffolding.Changes
P0 — integrity
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_canary rule (module 42)<!-- cyberlab-enriched -->markers + trailing bare-URL dumps from all 61P1 — de-bloat
## MITRE ATT&CK & DFIR phaseacross all 61 modules (~11,000 lines, ~40% of the lab)Validation
Not in this PR (deferred, see report)
Draft for review — nothing merged to
main.🤖 Generated with Claude Code