Summary

Adds AIMDS/crates/aidefence-core, a Rust detection core in the AIMDS Cargo workspace, so Rust services (the cognitum-one Slack bot, cognitum-cogs) run the same AIDefence detection as the npm package.

Stacked on feat/aidefence-injection-packs (the pattern-pack PR #105, #105, head 2bb5f27): the base of this PR is that branch, so the diff here is the crate only. Merge that PR first, then retarget this PR to main (gh pr edit 102 --base main) before the pack branch is deleted.

• One pattern source, nothing hand-copied. The crate embeds AIMDS/patterns/*.json at build time (include_str!) and can load the same directory at runtime (Registry::from_dir). The core pack is the 25-pattern set of @claude-flow/aidefence 3.0.2 (ruflo v3/@claude-flow/aidefence/src/domain/services/threat-detection-service.ts, the code behind aidefence_scan); the other five packs cover the misses measured 2026-09-04. Note: midstream AIMDS/src and the published aidefence@2.3.0 carry no detection regexes of their own.
• Engine parity. Mirrors AIMDS/src/detection/engine.ts: normalisation (NFKC, invisibles, the same confusables table, newlines kept), separator / leet / compact variants with \s+-free compact regexes, bounded base64 / hex / url / rot13 / reverse decoding with one rescan, per-id dedupe, variant confidence penalties.
• Explicit divergence ledger (Registry::divergences, asserted in tests): CORE-005's trailing (?!going|about|ready) becomes a not_followed_by post-check (one documented gap: JS would still match you are now going with two spaces). Counted repeats with a bound of 1024+ would be relaxed to unbounded and listed too, but the pack PR already replaced its {n,2048} bounds with +/*?, so today: 1 rewritten, 0 skipped, 0 errors across 53 patterns. Mid-pattern lookaround or backreferences are load errors; "engine": "js" patterns that fail become Skipped, never silent drops.
• Parity test on the shared corpus. tests/parity.rs runs AIMDS/tests/fixtures/injection-corpus.json (85 cases) and requires, per case, the same pattern ids, matching variant, decoding and confidence as the TS engine (tests/fixtures/ts-expected.json, generated with tsx from the TS engine at 2bb5f27; regeneration one-liner in the README). The TS unit assertions are mirrored one for one (known FPs F13/F27 = exactly CORE-018, leet case, decoded-from, no recursion, candidate cap, core-only 3.0.2 verdicts).
• API: detect, is_safe, sanitize (idempotent, PII-masking, never truncates), normalize, decode_and_rescan, Detector + Config (pack overrides honouring enabledByDefault, variants/decode toggles, 100 KB truncation, unsafe threshold). PII (6 patterns) lives in the crate's patterns/pii.json because the shared packs carry none; the TS email class [A-Z|a-z] typo is fixed there.
• wasm feature (wasm-bindgen exports) is cargo checked on wasm32-unknown-unknown; no wasm-pack build or JS smoke test.
• AIMDS/Cargo.toml: crate added to members; regex crates set to opt-level = 3 in the dev profile (the packs' heavy regexes made the 100 KB latency gate ~290 ms unoptimised).

Not ported (stated in README): ThreatLearningService (ReasoningBank-style learning, HNSW similarity, mitigation tracking), behavioural analysis, policy verification, inputHash, quickScan/getStats, and 3.0.2's confidence arithmetic (both engines use the pack model instead).

Recommendation. AIMDS/crates/aimds-detection still carries its own older 10-literal + 5-regex matcher and PII sanitizer; it is untouched here and should be unified onto these packs in a follow-up so the workspace has one detection engine.

Test plan

cargo test -p aidefence-core            # 45 tests: 20 unit, 6 examples, 7 parity, 3 perf, 6 proptest, 2 loader, 1 doctest
cargo clippy -p aidefence-core --all-targets -- -D warnings
cargo fmt -p aidefence-core -- --check
cargo check -p aidefence-core --target wasm32-unknown-unknown --features wasm
cargo check -p aimds-detection          # workspace neighbour still builds

• Perf, 100 KB adversarial input (4 variants, 3 decoded candidates), 200 ms bound: dev profile 25 ms detect / 32 ms sanitize; release 10 ms / 3 ms.
• Not covered by CI: rust-ci.yml runs the root workspace only and AIMDS is a separate workspace with a gitignored Cargo.lock, so these gates ran locally (rustc 1.97; rust-version = "1.81" declared, not verified). The crate embeds files outside its package root, so it is a git dependency, not publishable to crates.io as-is.

🤖 Generated with RuFlo

https://claude.ai/code/session_013PKv3picsfzoQJDKLLW7Rt