concept → source file → page

Coverage matrix

A map from each concept to the source file that evidences it and the page that explains it, numbered 1 to 10. Where the repo diverges or a name does not match a file, the marking is open. Protection is described as a sum of layers (the coefficient), never as a count of visitors.

✓ no código parcial / sutileza nome de sinal, não arquivo

1 · The POSIX contract and exit 2

Concept	Source file	Page	Status
exit code as contract; the exit 2	hooks/nemesis-pretool-check-unix.rs:190-194	1	✓
POSIX process model, stdio, spawn	main.rs:106-126; pretool reads stdin	1	✓

2 · Kernel, eBPF and LSM

Concept	Source file	Page	Status
kernel vs userspace; bprm_check_security hook	ebpf/nemesis-block.bpf.c:68-138	2	✓
eBPF: verifier, maps (hash/ringbuf/array/LPM trie)	nemesis-block.bpf.c:20-67	2	✓
BPF-LSM as the decision point	nemesis-block.bpf.c:68,173	2	✓

3 · Kernel confinement and egress

Concept	Source file	Page	Status
scope by the agent cgroup	nemesis-block.bpf.c:83-94	3	✓
Landlock without root (no_new_privs)	ebpf-kernel/src/landlock.rs:24-38	3	✓
egress allowlist, C2, fail-closed	bpf.c:173-205; src/egress.rs:1-6	3	✓
capabilities	posture (no_new_privs, no root), not an explicit call	3	princípio aplicado, não feature isolada

4 · Rust as a defense language

Concept	Source file	Page	Status
workspace and committed Cargo.lock	Cargo.toml:1-9; release.yml (--locked)	4	✓
Result/Option, errors without exceptions	main.rs:149-156	4	✓
fail-closed (catch_unwind → exit 2)	nemesis-pretool-check-unix.rs:1023-1041	4	✓
linear regex/ReDoS; limits against DoS	crate regex; decoder.rs:22-28	4	✓

5 · AST, pipeline and semantic detection

Concept	Source file	Page	Status
AST, tree-sitter, Visitor pattern	ast_scanner.rs:58-79; visitors/mod.rs	5	✓
layered pipeline	lib.rs:242-288	5	cabeçalho de scanner/mod.rs diz 6; execução tem mais chamadas
Shannon entropy	entropy.rs:14-40	5	✓
taint tracking (3 passes)	taint_tracker.rs:251-318	5	✓

6 · Pretool, defender and daemon

Concept	Source file	Page	Status
multi-IDE interception (tool translation)	pretool:312-347	6	✓
compute_severity (pure function, deterministic)	lib.rs:413-437	6	✓
daemon, fire-and-forget, quarantine	pretool:1107-1141; quarantine.rs:1-11	6	✓

7 · Prompt injection and IDE poisoning

Concept	Source file	Page	Status
prompt injection, system prompt extraction	prompt_injection.rs:1-29	7	✓
IDE poisoning, authority injection, fake scan	ide_config_poisoning.rs:157-206	7	✓

8 · Malicious code and supply chain

Concept	Source file	Page	Status
decode→exec (decoder runs and rescans)	decoder.rs:200-217; visitors/decode_exec.rs	8	✓
multi-runtime reverse shell	lib.rs:387 (sinal CONFIRMATÓRIO)	8	sinal `reverse_shell`, sem arquivo de visitor próprio
evasion: self-clean, time-gated, Unicode steg (Trojan Source)	self_clean.rs; time_gated.rs; byte_scanner.rs:17-46; unicode_steg.rs	8	✓
manifests (postinstall/build.rs), typosquat, lockfiles	manifest_scanner.rs:1-12; manifest_abuse.rs	8	registry_redirect é nome de sinal
credential harvest + exfil chain (source+sink)	credential_harvest.rs; exfil_chain.rs:192-247	8	✓

9 · Defense in depth and decision

Concept	Source file	Page	Status
3 independent layers; eBPF as backstop	pretool:1107-1141; lib.rs:216-232	9	✓
severity, corroboration (Tier A/B), reversible quarantine	lib.rs:377-437; quarantine.rs:1-11	9	✓

10 · Process and honesty

Concept	Source file	Page	Status
threat model, declared limits (trusting-trust)	self-audit.yml:10-17; AGENTS.md §2/§10	10	✓
DevSecOps: SLSA, self-audit, CODEOWNERS	self-audit.yml:85-89; release.yml:8-16; CODEOWNERS:18-21	10	SLSA declarado no release.yml, não fixado linha a linha
nemesis-doctor (observability)	nemesis-doctor/src/main.rs:10; checks/mod.rs:3-9	10	G1/G2/G7 nomeados; demais por módulo
red-teaming (pentest as gate)	run-pentest.sh; self-audit.yml:85-89	10	✓

Protection layers (the coefficient)

Protection is the sum of independent layers (pretool plus daemon plus eBPF), the coefficient. Not the count of visitors; the empirical proof is the pentest suite. — Protection = sum of layers. A visitor is a detection method, not a unit of coverage; the proof is the pentest.

Nemesis protection is the sum of layers, not the count of visitors (a visitor is a method, not a vector). Broken down per layer:

Layer	What it blocks (examples)	Source
Pretool + eBPF (command; kernel on Linux)	destruction, permissions, filesystem, database, exfil, recon/exploit, persistence/privesc	denylist-ebpf/commands.toml; .nemesis/denylist/
eBPF: exec + egress (Linux)	`-EPERM` on exec of a blocked command and connection outside the egress allowlist	nemesis-block.bpf.c:68-138, 173-205; egress.toml
Defender: embedded deny-list (content)	37 categorias (reverse_shells, data_exfiltration_compound, persistence_mechanisms, supply_chain_registry, container_escape, prompt_injection_*, llm_template_injection, xss_unsanitized_html, nemesis_evasion, pii_detection, ...)	denylist-defender.json (.categories); embutida via include_str! (denylist_loader.rs:33)
Defender: scanner + AST visitors (method)	byte (BiDi/PUA/homoglyph/zero-width), entropy, regex, manifest, recursive decoder; and the semantic-intent visitors	scanner/; visitors/ (15 arquivos de visitor)

Empirical proof: the static pentest suite as a CI gate. Canonical rule of the framing: AGENTS.md §3A.

What diverges and what is not fixed

"18 visitors": the code has 15 visitor files. Names like reverse_shell and manifest_registry_redirect are emitted signals (in regex/decoder/manifest_scanner), not visitor files. And, either way, counting visitors does not measure coverage: a visitor is a method.
Pipeline order: the scanner/mod.rs comment says six layers; the real execution in lib.rs has more calls (byte with four sub-scans, plus ide and exfil). The matrix and page 5 follow the code.
Pentest count: the sources diverge (run-pentest.sh cites "184 tests / 26 modules"; self-audit.yml and AGENTS.md cite "194/194"). The script auto-detects; no number that could go stale is fixed here, and the divergence is pointed out. Detail on page 10.
SLSA: the attestation is in the release flow; this material describes it and points to the file, without pinning lines that could go stale.
nemesis-doctor: the code names G1 (compile), G2 (tests) and G7 (pentest) in the help; the other groups map to the checks/ modules.

Voltar ao índice.