
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@getbourdon/recognition
Advanced tools
Bourdon recognition timing core: the synchronous recognition-FIRST runtime (recognition string emitted in ~0ms, lazy-thunk L1 hydration that never blocks/raises), the cross-surface recognition contract (tokenizer/STOPWORDS/MatchTier ladder/confidence buck
The recognition timing core of Bourdon — the synchronous recognition-FIRST runtime, the cross-surface recognition contract, and the precision/recall/F1 eval harness.
Python (pip install bourdon) is the oracle. This TypeScript mirror is conformant iff it
reproduces the oracle's output on the shared @getbourdon/conformance fixtures
(recognition_vectors.json + recognition_golden_v1.yaml). It is the 4th parity engine:
claude-code / codex / cursor / TS all agree on the same (prompt, manifest) → tier + confidence bucket + recognition string.
() => Promise<string> (mirrors Python's un-started coroutine). It
must NOT execute during recognitionFirst; the caller controls start. It NEVER blocks the first
response and NEVER rejects — timeout/error degrade to '' (L0-only).recognitionConfidence is tier-only. The emitted bucket is a pure function of
bestMatchTier(prompt, name+aliases). nAnchorTerms / cwdHit / recencyFresh drive RANKING on
other surfaces only; folding them into the emitted bucket would break parity (other surfaces can't
see them, and parity requires equality)."Bourdon-AI v2" → [bourdon, ai, v2]), lowercases, and keeps
duplicates + order — never a Set for the ladder."ILTTed" does NOT match "ILTT" (iltt is a substring of iltted but not a whole-token
subsequence of the prompt's tokens).normalizedConfidence runs Math.round(score*1e4)/1e4 before comparing to the 0.45 and
0.80 bucket boundaries (kills float-sum drift). Both edges are pinned by fixtures.detectEntities prefilters with a token-set subset test (a sound necessary condition only);
the full match_tier ladder still decides, and the gate requires >= TOKEN_SUBSEQUENCE.filterManifestForAccess runs before detection, so a private entity can never surface." -- " (double-hyphen, not an em-dash) and "You're"
(straight apostrophe).orchestrator.py's legacy substring detect_entities is the decoy prototype — it had short-name
false positives ("baNAS" matched "NAS"). It is intentionally NOT ported. The contract's
token-subsequence ladder is the only matcher in this package.
BUSL-1.1 (Business Source License 1.1) — this is engine code, not the permissive wire/interop
surface. See LICENSE and LICENSE_FAQ.md. (@getbourdon/recognition may depend on the Apache-2.0
@getbourdon/l5; the reverse — Apache importing BUSL — is forbidden.)
FAQs
Bourdon recognition timing core: the synchronous recognition-FIRST runtime (recognition string emitted in ~0ms, lazy-thunk L1 hydration that never blocks/raises), the cross-surface recognition contract (tokenizer/STOPWORDS/MatchTier ladder/confidence buck
The npm package @getbourdon/recognition receives a total of 5,602 weekly downloads. As such, @getbourdon/recognition popularity was classified as popular.
We found that @getbourdon/recognition demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.