{
  "$comment": "Fixture for malware-signatures.test.mjs graceful-degradation cases. Not a commons artifact: a hand-written ruleset whose rules are individually broken in the ways vendored data can plausibly be broken, plus one rule carrying only the two required fields so the loader's documented defaults (family -> 'unknown', severity -> 'high', description -> the id, provenance -> null) can be observed rather than assumed. A builder that survives this file survives a corrupt commons without throwing at module load.",
  "version": "0.0.0-fixture",
  "id": "fixture/malformed-malware-signatures",
  "rules": [
    {
      "id": "FIX-OK-001",
      "family": "webshell",
      "severity": "critical",
      "pattern": "fixture-shape-a",
      "description": "a well-formed rule carrying all six fields",
      "provenance": "fixture"
    },
    {
      "id": "FIX-UNCOMPILABLE-001",
      "family": "webshell",
      "severity": "critical",
      "pattern": "(?:unclosed[",
      "description": "uncompilable: unbalanced group and class",
      "provenance": "fixture"
    },
    {
      "family": "webshell",
      "severity": "high",
      "pattern": "fixture-missing-id",
      "description": "no id — dropped by the loader",
      "provenance": "fixture"
    },
    {
      "id": "FIX-NO-PATTERN-001",
      "family": "webshell",
      "severity": "high",
      "description": "no pattern — dropped by the loader",
      "provenance": "fixture"
    },
    null,
    {
      "id": "FIX-DEFAULTS-001",
      "pattern": "fixture-shape-b"
    }
  ]
}