Signature schema

Confirmed poison is a line in feed/signatures.jsonl. The scanner reads this file locally. Nobody needs an account. The repo is the feed. Cloning is the update.

Line format

One JSON object per line. Unknown fields are ignored.

{
  "id": "AS-2026-0001",
  "attack": "trigger",
  "match": "literal",
  "pattern": "zxq9 violet lantern",
  "confidence": 0.95,
  "example_hashes": ["b4c8..."],
  "notes": "Why this is poison, and where it was first seen."
}

Field	Required	Meaning
`id`	yes	Stable public id. Use `AS-YYYY-NNNN` for new feed rows.
`match`	yes	`literal` (case-insensitive substring on NFKC text), `regex` (on NFKC text), or `sha256` (hash of whitespace/punct-normalized NFKC text).
`pattern`	yes	The substring, regex, or hex digest.
`attack`	no	`trigger`, `label_flip`, `duplicate_inject`, `paraphrase_overweight`, `stat_outlier`, `canary`, or a short new tag.
`confidence`	no	Number between 0 and 1.
`example_hashes`	no	`sha256` hex digests of normalized example texts.
`notes`	no	Human context for reviewers.

How a signature gets in

A local scan flags a row (antiserum scan ./data --out receipt.json).
First-pass applies the published rubric (antiserum judge ./data --receipt receipt.json).
A human settles needs_human leftovers (antiserum confirm or by editing the judgments file). See docs/confirm.md.
antiserum propose --judgments judgments.json emits the next AS-YYYY-NNNN line and a PR body.
You open a pull request that adds that line to feed/signatures.jsonl and records the id under today's date in feed/CHANGELOG.md.
Reviewers check the pattern is specific enough not to torch clean data.
Once merged, every later scan can hit it. People who want a pin use a git tag pack-YYYY-MM-DD.

The reference mix (corpus/reference/) adds a few family lines (AS-2026-0003–0006): one shared pattern per trigger or dump family, not a line per plant. Reviewers still check those patterns stay off clean rows. make reproduce fails if they miss their plants or start hitting the clean majority.

AS-2026-0007 is a research-plant literal for per RFC 8472 section 3.2 (field hunt 28 Aug 2026). It must not match ordinary prompt-injection rows that lack that phrase. Hunt writeup: threat-model.md. Standing hunt (open mixes, no vendored dumps): field-hunt.md. The 5 Sep 2026 |prod| miss is a canary-path fix, not a new feed line.

Do not open a PR that only says "this is bad" without a pattern another machine can match.

Pack releases

The living file is feed/signatures.jsonl. Dated releases live in feed/CHANGELOG.md: pack date plus added and removed ids.

There is no download server, no marketplace, and no "latest" HTTP fetch. A receipt already records the sha256 of the local pack you scanned. To pin a pack, check out the git tag:

git checkout pack-YYYY-MM-DD
antiserum scan ./data

A signature PR that adds or removes ids updates the changelog under that day's heading (or starts a new ## YYYY-MM-DD section). Maintainers who want a pin tag the merge commit pack-YYYY-MM-DD.

The review bar does not change: the pattern must not torch clean rows. make reproduce still fails if family lines miss their plants or start hitting the clean majority.