Module defense 

Observation-only defensive posture layer.

Runtime scope

• Build: always/default.
• Execution: observation/shadow composition is assessment-only. The standalone standard runtime remains unchanged; assessment enforcement is an explicit opt-in and defaults off.
• Default termivar scan: no.
• Support: implemented and tested.

See docs/internals/runtime-map.md.

This module turns raw response signals into a typed, bounded observation of a target’s defensive behavior — product fingerprints and an overall DefenseState. It never selects a payload or an evasion technique: that decision belongs to the planner, which consumes these observations. This separation is deliberate, so a defensive-fingerprint change can never silently change attack behavior.

The former legacy WAF detector/evasion utility has been removed. Payload derivation lives behind crate::payload_strategies.

Re-exports

pub use enforcement::defense_aware_plan;

pub use enforcement::DefensePlanningPolicy;

pub use fingerprint::fingerprint;

pub use fingerprint::DefenseFingerprint;

pub use fingerprint::DefenseProduct;

pub use fingerprint::FingerprintConfidence;

pub use fingerprint::MAX_FINGERPRINT_BODY_SCAN_BYTES;

pub use policy::recommend;

pub use policy::DefenseResponse;

pub use projection::project_defense_state;

pub use projection::project_defense_transition;

pub use projection::project_outcome;

pub use projection::DefenseObservationContext;

pub use projection::ObservedOutcome;

pub use shadow_planning::decide;

pub use shadow_planning::defense_aware_shadow_plan;

pub use shadow_planning::explanation_code;

pub use shadow_planning::render_explanation;

pub use shadow_planning::DefenseAwareShadowPlan;

pub use shadow_planning::DefenseInteractionClass;

pub use shadow_planning::InteractionDecision;

pub use shadow_planning::PlanAdjustment;

pub use shadow_planning::ResourceDefenseObservation;

pub use shadow_planning::ResourceDefenseSignal;

pub use shadow_planning::ShadowPlanDelta;

pub use shadow_planning::SuppressedAction;

pub use state::DefensePosture;

pub use state::DefenseState;

pub use state::DefenseStatusSignal;

pub use transition::DefenseTransition;

pub use transition::DefenseTransitionKind;

pub use transition::PostureShift;

Modules

enforcement

Default-off enforcement of defense-aware planning.

fingerprint

Robust, deterministic defense-product fingerprinting from response signals.

policy

Deterministic escalation policy over observed defense evidence.

projection

Projection of observed defense state into provenance-carrying evidence.

shadow_planning

Side-effect-free, defense-aware shadow planning.

state

Observed defensive posture of a single HTTP response.

transition

Deterministic comparison of two observed defense states.