Source Validation Matrix

How to read support claims

A source is supported only when the required coverage gates have fixture-backed proof for that exact identity. Live host validation is useful operational context, but it is not the support gate and should not require scanning large or sensitive real stores.

• Eight supported identities across six agent families. Acquisition accepts only those exact pairs; there are no hidden candidate registrations.
• Fixture-backed plus bounded live validation: Codex, OpenCode, Claude Code, and GitHub Copilot.
• Fixture-backed only: Qwen CLI and OpenClaw. Preview for live stores.
• Retired and not registered: `gemini.tmp`, `opencode.legacy_json`, `opencode.project_json`, `roocode.tasks`, `kilocode.tasks`, and `codex.project_sessions`.
• Public examples use synthetic fixtures and bounded dry-run commands, not raw local transcripts.

Client evidence matrix

Each row is one registered source identity. Canonical observations are not the raw store. Conditional or unknown fields are not complete execution evidence. Packaging smoke checks do not establish live source-store coverage.

Required coverage gates

Before a source is advertised as supported, the Telltale source-validation matrix requires deterministic coverage that can run from a clean checkout.

• Discovery finds the expected fixture files.
• A benign fixture is extracted and acquired, with native accounting and progress checked.
• A tool-call fixture maps to the expected canonical observation.
• A tool-result fixture maps to the expected canonical observation.
• UC-001 has a positive detection, or a contract-backed capability gap that proves the attack content survived acquisition. Copilot is that gap: UserContext is unsupported, so the chain does not fire. A missing fixture is not a visibility gap.
• A genuinely observed benign fixture has no UC-001 matches. Other signals, such as `execution.shell`, may still fire. A quiet result under an unsupported capability is not an efficacy true negative.
• Absent, conditional, and unknown fields are documented before the source is user-visible.

Adding or changing a source

The contributor checklist separates session discovery from install inventory. It requires exact source ownership, native extraction, canonical mapping, adapter conformance, positive and negative detection fixtures, and capability notes before any support claim.

cargo test --locked --test evaluation_corpus uc001_

Safe validation commands

Use fixture-backed checks first. When checking real stores, keep the scan bounded, read-only, and summarized without publishing raw paths or transcripts.

cargo run --bin telltale -- scan --once --dry-run --no-local-config --root tests/fixtures/session_stores
cargo run --bin telltale -- rules validate --no-local-config

telltale scan --once --dry-run --root "$HOME" --client codex --max-sources 5

Project-local source discovery

Copilot process logs are the only project-local source. Project discovery is additive to home-relative sources from `--root`. With no project config and a scan root of `.`, Telltale uses `~/github` and `~/projects` when those directories exist. An explicit project file replaces that default. `--root "$HOME"` alone does not load it.

projects:
  - name: my-project
    path: ~/github/my-project

telltale scan --once --root "$HOME" --project-config projects.yaml

What not to overclaim

• Do not describe Qwen or OpenClaw as live-validated, or retired identities as supported.
• Do not treat canonical observations as the raw store. Preserve the original session store separately.
• Do not treat a quiet Copilot UC-001 result as proof the attack content was absent. User context is unsupported.
• Do not say Codex or OpenCode exit codes are always absent, or that Copilot never preserves a call ID.
• Do not publish workstation-specific session paths, transcript identifiers, credentials, telemetry logs, or SIEM configuration from live validation.