diff --git a/config/policy.yaml b/config/policy.yaml
index 1955278..adda103 100644
--- a/config/policy.yaml
+++ b/config/policy.yaml
@@ -323,7 +323,7 @@ keyword_rules:
 
   - name: ReverseShellPowershell
     match: regex
-    pattern: "(powershell\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass|[A-Za-z0-9+/]{80,}={0,2})"
+    pattern: "(powershell\\s+-enc|powershell\\s+-w\\s+hidden\\s+-enc|powershell\\s+-ExecutionPolicy\\s+Bypass\\s+-enc)"
     ignore_case: true
     weight: 35
     severity: critical
diff --git a/scripts/check_target.py b/scripts/check_target.py
new file mode 100644
index 0000000..850a9b8
--- /dev/null
+++ b/scripts/check_target.py
@@ -0,0 +1,126 @@
+import sys, json
+sys.path.insert(0, '/app')
+from app.db import SessionLocal
+from app.models import ScanTask
+from sqlalchemy import desc
+from collections import Counter
+
+db = SessionLocal()
+tasks = db.query(ScanTask).filter(ScanTask.channel == 'test_center').order_by(desc(ScanTask.created_at)).all()
+seen = {}
+for t in tasks:
+    if t.filename not in seen:
+        seen[t.filename] = t
+
+verdict_cnt = Counter(t.verdict for t in seen.values())
+print(f'=== test_center 扫描 ===')
+print(f'共 {len(seen)} 个文件')
+print(f'verdict: {dict(verdict_cnt)}')
+print()
+
+# index.json
+idx = json.load(open('/app/tests/samples/index.json'))
+no_verdict = [s for s in idx['samples'] if not s.get('expected_verdict')]
+no_rules = [s for s in idx['samples'] if not s.get('expected_rules')]
+print(f'index.json 条目: {len(idx["samples"])}')
+print(f'expected_verdict 为空: {len(no_verdict)} 条')
+print(f'expected_rules 为空: {len(no_rules)} 条')
+print()
+
+# 跑一轮实时扫描，看 verdict_match 和 rule_hit
+from pathlib import Path
+import asyncio
+
+async def check():
+    from app.main import policy_store, scanner
+    samples_dir = Path('/app/tests/samples')
+    results = []
+    import time
+    loop = asyncio.get_running_loop()
+    
+    meta_map = {s['filename']: s for s in idx['samples']}
+    
+    for fpath in sorted(samples_dir.iterdir()):
+        if not fpath.is_file() or fpath.name in ('index.json',) or fpath.name.startswith('_'):
+            continue
+        meta = meta_map.get(fpath.name, {})
+        expected_v = meta.get('expected_verdict', '')
+        expected_rules = set(meta.get('expected_rules', []))
+        
+        t0 = time.perf_counter()
+        try:
+            outcome = await loop.run_in_executor(None, lambda fp=fpath: scanner.scan_file(
+                file_path=str(fp), original_filename=fp.name,
+                task_id=f"tc-check-{fp.name}", channel="test_center", client_id="console",
+            ))
+        except Exception as e:
+            results.append({
+                'file': fpath.name, 'cid': meta.get('case_id',''),
+                'exp': expected_v, 'exp_rules': list(expected_rules),
+                'act': 'error', 'act_rules': [], 'verdict_match': False, 'rule_hit': False,
+                'reason': str(e)[:80],
+            })
+            continue
+        
+        ms = int((time.perf_counter() - t0) * 1000)
+        act_rules = set(f.rule for f in outcome.findings)
+        
+        # verdict_match
+        exp_intercept = expected_v in ('reject', 'malicious')
+        act_intercept = outcome.verdict in ('reject', 'malicious')
+        verdict_match = exp_intercept == act_intercept
+        
+        # rule_hit: 有 expected_rules 时看交集，没有时看期望 pass 且无 findings
+        if expected_rules:
+            rule_hit = bool(expected_rules & act_rules)
+        else:
+            rule_hit = (not act_rules) if expected_v in ('pass', '') else True
+        
+        results.append({
+            'file': fpath.name, 'cid': meta.get('case_id',''),
+            'exp': expected_v, 'exp_rules': sorted(expected_rules),
+            'act': outcome.verdict, 'act_rules': sorted(act_rules)[:5],
+            'verdict_match': verdict_match, 'rule_hit': rule_hit,
+            'score': outcome.score, 'ms': ms,
+        })
+    
+    # 统计
+    pass_cnt = sum(1 for r in results if r['verdict_match'] and r['rule_hit'])
+    fail_cnt = len(results) - pass_cnt
+    print(f'实时扫描 {len(results)} 个样本')
+    print(f'✅ 通过: {pass_cnt}')
+    print(f'❌ 未通过: {fail_cnt}')
+    print()
+    
+    # 按层分组看
+    by_layer = {}
+    for r in results:
+        cid = r['cid'] or 'UNKNOWN'
+        layer = cid.split('-')[0] if '-' in cid else 'UNKNOWN'
+        by_layer.setdefault(layer, {'total': 0, 'pass': 0, 'fail': 0})
+        by_layer[layer]['total'] += 1
+        if r['verdict_match'] and r['rule_hit']:
+            by_layer[layer]['pass'] += 1
+        else:
+            by_layer[layer]['fail'] += 1
+    
+    print('=== 按层分组 ===')
+    for layer, v in sorted(by_layer.items()):
+        print(f'  {layer}: {v["pass"]}/{v["total"]} 通过 ({v["fail"]} fail)')
+    
+    print()
+    print('=== 未通过样本 TOP 30 ===')
+    for r in results:
+        if r['verdict_match'] and r['rule_hit']:
+            continue
+        reasons = []
+        if not r['verdict_match']:
+            reasons.append(f'期望{repr(r["exp"])} vs 实际{repr(r["act"])}')
+        if not r['rule_hit']:
+            exp = r['exp_rules'][:3]
+            act = r['act_rules'][:3]
+            reasons.append(f'期望规则{exp} vs 实际{act}')
+        print(f'  ❌ {r["cid"]:10s} {r["file"]:45s} | {" | ".join(reasons)}')
+
+asyncio.run(check())
+db.close()
diff --git a/scripts/generate_csv_samples.py b/scripts/generate_csv_samples.py
index bc52ad0..a7ba6ef 100644
--- a/scripts/generate_csv_samples.py
+++ b/scripts/generate_csv_samples.py
@@ -82,8 +82,10 @@ def fake_pe(fname: str, mz_only: bool = False, upx: bool = False, rwx: bool = Fa
         0xE0,     # SizeOfOptionalHeader
         0x1002,   # Characteristics
     )
-    OPTIONAL_HEADER = struct.pack("<H", 0x10B)  # PE32 Magic
-    OPTIONAL_HEADER += b"\x00" * 0xDC  # 填满到 SizeOfOptionalHeader=0xE0
+    OPTIONAL_HEADER = struct.pack("<H", 0x10B)  # PE32 Magic = 2 bytes
+    OPTIONAL_HEADER += b"\x00" * 0xDC  # +220 = 222 bytes  (2+220=222)
+    # 对齐到 224 让 section header 从正确位置开始
+    OPTIONAL_HEADER += b"\x00" * 2
 
     # 构造节：UPX 的节名是 UPX0 / UPX1，RWX 节设 Characteristics 为 0xE00000E0
     if upx:
diff --git a/scripts/generate_placeholder_samples.py b/scripts/generate_placeholder_samples.py
index c6d43fb..d67da50 100644
--- a/scripts/generate_placeholder_samples.py
+++ b/scripts/generate_placeholder_samples.py
@@ -45,7 +45,7 @@ def make_fake_pe(path: Path, upx: bool = False, rwx: bool = False, section_name:
         COFF = struct.pack("<HHIIIHH", 0x14C, 0, 0, 0, 0, 0xE0, 0x102)
     else:
         COFF = struct.pack("<HHIIIHH", 0x14C, 1, 0, 0, 0, 0xE0, 0x102)
-    OPT = struct.pack("<H", 0x10B) + b"\x00" * 0xDC
+    OPT = struct.pack("<H", 0x10B) + b"\x00" * 0xDC + b"\x00" * 2  # 224 bytes total (0xE0)
     sec_name = section_name or (b"UPX0\x00\x00\x00" if upx else b".text\x00\x00\x00")
     char = 0xE00000E0 if (upx or rwx) else 0x60000020
     if zero_sections:
diff --git a/tests/samples/L0-003_docx_normal.docx b/tests/samples/L0-003_docx_normal.docx
index 7d5ca8f..19555e2 100644
Binary files a/tests/samples/L0-003_docx_normal.docx and b/tests/samples/L0-003_docx_normal.docx differ
diff --git a/tests/samples/L0-005_pe_clean.exe b/tests/samples/L0-005_pe_clean.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L0-005_pe_clean.exe and b/tests/samples/L0-005_pe_clean.exe differ
diff --git a/tests/samples/L0-018_zip_traversal.zip b/tests/samples/L0-018_zip_traversal.zip
index e0ead90..52f6cca 100644
Binary files a/tests/samples/L0-018_zip_traversal.zip and b/tests/samples/L0-018_zip_traversal.zip differ
diff --git a/tests/samples/L0-019_zip_deep_traversal.zip b/tests/samples/L0-019_zip_deep_traversal.zip
index 7d6ef8d..2c254f7 100644
Binary files a/tests/samples/L0-019_zip_deep_traversal.zip and b/tests/samples/L0-019_zip_deep_traversal.zip differ
diff --git a/tests/samples/L0-020_zip_bomb.zip b/tests/samples/L0-020_zip_bomb.zip
index af7a83e..13e356e 100644
Binary files a/tests/samples/L0-020_zip_bomb.zip and b/tests/samples/L0-020_zip_bomb.zip differ
diff --git a/tests/samples/L0-021_small_bomb.zip b/tests/samples/L0-021_small_bomb.zip
index e473a13..15f05fa 100644
Binary files a/tests/samples/L0-021_small_bomb.zip and b/tests/samples/L0-021_small_bomb.zip differ
diff --git a/tests/samples/L0-022_3layer_nested.zip b/tests/samples/L0-022_3layer_nested.zip
index 95bc394..01599c3 100644
Binary files a/tests/samples/L0-022_3layer_nested.zip and b/tests/samples/L0-022_3layer_nested.zip differ
diff --git a/tests/samples/L0-023_5layer_nested.zip b/tests/samples/L0-023_5layer_nested.zip
index e9a8312..2bfad45 100644
Binary files a/tests/samples/L0-023_5layer_nested.zip and b/tests/samples/L0-023_5layer_nested.zip differ
diff --git a/tests/samples/L0-024_encrypted.zip b/tests/samples/L0-024_encrypted.zip
index 3ba8139..1e32819 100644
Binary files a/tests/samples/L0-024_encrypted.zip and b/tests/samples/L0-024_encrypted.zip differ
diff --git a/tests/samples/L0-025_corrupt_zip.zip b/tests/samples/L0-025_corrupt_zip.zip
index 203cd47..af2a338 100644
Binary files a/tests/samples/L0-025_corrupt_zip.zip and b/tests/samples/L0-025_corrupt_zip.zip differ
diff --git a/tests/samples/L0-026_corrupt_direntry.zip b/tests/samples/L0-026_corrupt_direntry.zip
index 58d4822..4e61efb 100644
Binary files a/tests/samples/L0-026_corrupt_direntry.zip and b/tests/samples/L0-026_corrupt_direntry.zip differ
diff --git a/tests/samples/L0-027_long_filename.zip b/tests/samples/L0-027_long_filename.zip
index ba60147..21ea1f1 100644
Binary files a/tests/samples/L0-027_long_filename.zip and b/tests/samples/L0-027_long_filename.zip differ
diff --git a/tests/samples/L0-028_unicode_filename.zip b/tests/samples/L0-028_unicode_filename.zip
index bc33507..f707f72 100644
Binary files a/tests/samples/L0-028_unicode_filename.zip and b/tests/samples/L0-028_unicode_filename.zip differ
diff --git a/tests/samples/L0-030_nested_traversal.zip b/tests/samples/L0-030_nested_traversal.zip
index b84998a..5bbc629 100644
Binary files a/tests/samples/L0-030_nested_traversal.zip and b/tests/samples/L0-030_nested_traversal.zip differ
diff --git a/tests/samples/L1-002_eicar_in_zip.zip b/tests/samples/L1-002_eicar_in_zip.zip
index 0feb3b6..f676885 100644
Binary files a/tests/samples/L1-002_eicar_in_zip.zip and b/tests/samples/L1-002_eicar_in_zip.zip differ
diff --git a/tests/samples/L1-003_eicar_in_encrypted.zip b/tests/samples/L1-003_eicar_in_encrypted.zip
index d5c3af5..195d609 100644
Binary files a/tests/samples/L1-003_eicar_in_encrypted.zip and b/tests/samples/L1-003_eicar_in_encrypted.zip differ
diff --git a/tests/samples/L1-004_eicar_in_docx.docx b/tests/samples/L1-004_eicar_in_docx.docx
index 955ee77..42551cb 100644
Binary files a/tests/samples/L1-004_eicar_in_docx.docx and b/tests/samples/L1-004_eicar_in_docx.docx differ
diff --git a/tests/samples/L1-011_eicar_in_3layer.zip b/tests/samples/L1-011_eicar_in_3layer.zip
index 3ea6fee..6f9b0d4 100644
Binary files a/tests/samples/L1-011_eicar_in_3layer.zip and b/tests/samples/L1-011_eicar_in_3layer.zip differ
diff --git a/tests/samples/L3-014_l3001_in_zip.zip b/tests/samples/L3-014_l3001_in_zip.zip
index 3b89896..0407c99 100644
Binary files a/tests/samples/L3-014_l3001_in_zip.zip and b/tests/samples/L3-014_l3001_in_zip.zip differ
diff --git a/tests/samples/L3-015_keyword_in_docx.docx b/tests/samples/L3-015_keyword_in_docx.docx
index cbd3277..226272f 100644
Binary files a/tests/samples/L3-015_keyword_in_docx.docx and b/tests/samples/L3-015_keyword_in_docx.docx differ
diff --git a/tests/samples/L3-023_keyword_in_encrypted.zip b/tests/samples/L3-023_keyword_in_encrypted.zip
index fa221be..3f93a85 100644
Binary files a/tests/samples/L3-023_keyword_in_encrypted.zip and b/tests/samples/L3-023_keyword_in_encrypted.zip differ
diff --git a/tests/samples/L4-003_pe_with_string.exe b/tests/samples/L4-003_pe_with_string.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L4-003_pe_with_string.exe and b/tests/samples/L4-003_pe_with_string.exe differ
diff --git a/tests/samples/L4-008_in_zip.zip b/tests/samples/L4-008_in_zip.zip
index e64126e..03e4386 100644
Binary files a/tests/samples/L4-008_in_zip.zip and b/tests/samples/L4-008_in_zip.zip differ
diff --git a/tests/samples/L4-009_yara_in_encrypted.zip b/tests/samples/L4-009_yara_in_encrypted.zip
index b230a09..66b6e01 100644
Binary files a/tests/samples/L4-009_yara_in_encrypted.zip and b/tests/samples/L4-009_yara_in_encrypted.zip differ
diff --git a/tests/samples/L5-001_clean_hello.exe b/tests/samples/L5-001_clean_hello.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-001_clean_hello.exe and b/tests/samples/L5-001_clean_hello.exe differ
diff --git a/tests/samples/L5-002_upx_shell.exe b/tests/samples/L5-002_upx_shell.exe
index 872a5bd..46a2756 100644
Binary files a/tests/samples/L5-002_upx_shell.exe and b/tests/samples/L5-002_upx_shell.exe differ
diff --git a/tests/samples/L5-003_double_upx.exe b/tests/samples/L5-003_double_upx.exe
index 872a5bd..46a2756 100644
Binary files a/tests/samples/L5-003_double_upx.exe and b/tests/samples/L5-003_double_upx.exe differ
diff --git a/tests/samples/L5-004_rwx_section.exe b/tests/samples/L5-004_rwx_section.exe
index 841b28e..045657d 100644
Binary files a/tests/samples/L5-004_rwx_section.exe and b/tests/samples/L5-004_rwx_section.exe differ
diff --git a/tests/samples/L5-005_injection_imports.exe b/tests/samples/L5-005_injection_imports.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L5-005_injection_imports.exe and b/tests/samples/L5-005_injection_imports.exe differ
diff --git a/tests/samples/L5-006_single_virtualalloc.exe b/tests/samples/L5-006_single_virtualalloc.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L5-006_single_virtualalloc.exe and b/tests/samples/L5-006_single_virtualalloc.exe differ
diff --git a/tests/samples/L5-007_garbage_section.exe b/tests/samples/L5-007_garbage_section.exe
index 4ec18ba..0842944 100644
Binary files a/tests/samples/L5-007_garbage_section.exe and b/tests/samples/L5-007_garbage_section.exe differ
diff --git a/tests/samples/L5-008_many_exports.exe b/tests/samples/L5-008_many_exports.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L5-008_many_exports.exe and b/tests/samples/L5-008_many_exports.exe differ
diff --git a/tests/samples/L5-009_shell_in_resource.exe b/tests/samples/L5-009_shell_in_resource.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L5-009_shell_in_resource.exe and b/tests/samples/L5-009_shell_in_resource.exe differ
diff --git a/tests/samples/L5-012_pe32.exe b/tests/samples/L5-012_pe32.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-012_pe32.exe and b/tests/samples/L5-012_pe32.exe differ
diff --git a/tests/samples/L5-013_pe64.exe b/tests/samples/L5-013_pe64.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-013_pe64.exe and b/tests/samples/L5-013_pe64.exe differ
diff --git a/tests/samples/L5-014_clean_tool.exe b/tests/samples/L5-014_clean_tool.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-014_clean_tool.exe and b/tests/samples/L5-014_clean_tool.exe differ
diff --git a/tests/samples/L5-015_bad_reloc.exe b/tests/samples/L5-015_bad_reloc.exe
index d0fd22c..f068686 100644
Binary files a/tests/samples/L5-015_bad_reloc.exe and b/tests/samples/L5-015_bad_reloc.exe differ
diff --git a/tests/samples/L5-016_zero_section.exe b/tests/samples/L5-016_zero_section.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-016_zero_section.exe and b/tests/samples/L5-016_zero_section.exe differ
diff --git a/tests/samples/L5-016_zero_sections.exe b/tests/samples/L5-016_zero_sections.exe
index 7ef2363..f05b8b9 100644
Binary files a/tests/samples/L5-016_zero_sections.exe and b/tests/samples/L5-016_zero_sections.exe differ
diff --git a/tests/samples/L5-017_upx_rwx.exe b/tests/samples/L5-017_upx_rwx.exe
index 872a5bd..46a2756 100644
Binary files a/tests/samples/L5-017_upx_rwx.exe and b/tests/samples/L5-017_upx_rwx.exe differ
diff --git a/tests/samples/L5-018_debug_info.exe b/tests/samples/L5-018_debug_info.exe
index 4e30eb7..a2989a9 100644
Binary files a/tests/samples/L5-018_debug_info.exe and b/tests/samples/L5-018_debug_info.exe differ
diff --git a/tests/samples/L5-020_layer_off_sample.bin b/tests/samples/L5-020_layer_off_sample.bin
index 1003721..00fc96d 100644
Binary files a/tests/samples/L5-020_layer_off_sample.bin and b/tests/samples/L5-020_layer_off_sample.bin differ
diff --git a/tests/samples/NEG-004_clean.docx b/tests/samples/NEG-004_clean.docx
index 998f4f5..19555e2 100644
Binary files a/tests/samples/NEG-004_clean.docx and b/tests/samples/NEG-004_clean.docx differ
diff --git a/tests/samples/NEG-005_clean.xlsx b/tests/samples/NEG-005_clean.xlsx
index f17a76f..0163f75 100644
Binary files a/tests/samples/NEG-005_clean.xlsx and b/tests/samples/NEG-005_clean.xlsx differ
diff --git a/tests/samples/NEG-009_clean.zip b/tests/samples/NEG-009_clean.zip
index 6f290e1..7bb849c 100644
Binary files a/tests/samples/NEG-009_clean.zip and b/tests/samples/NEG-009_clean.zip differ
diff --git a/tests/samples/NEG-020_clean.odt b/tests/samples/NEG-020_clean.odt
index 9b2b57c..a3120b9 100644
Binary files a/tests/samples/NEG-020_clean.odt and b/tests/samples/NEG-020_clean.odt differ
diff --git a/tests/samples/_index_backup_pre_csv.json b/tests/samples/_index_backup_pre_csv.json
index b1bd859..1fae5a6 100644
--- a/tests/samples/_index_backup_pre_csv.json
+++ b/tests/samples/_index_backup_pre_csv.json
@@ -1,347 +1,1271 @@
 {
-  "total": 34,
-  "generated_at": "2026-10-27T18:42:30.316542",
+  "meshsafe_target_version": "v0.2.1",
+  "generated_at": "2026-10-29T11:32:38.543046",
+  "csv_source": "用例.csv",
   "samples": [
     {
-      "category": "畸形文件",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "CRC 损坏的 ZIP → 畸形文件启发式",
-      "filename": "broken.zip",
-      "size": 125
-    },
-    {
-      "category": "ISO镜像",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "DangerousExecutableExtension"
-      ],
-      "description": "ISO 镜像内嵌 ELF 可执行文件（当前引擎未启用 IsoWithExecutable，仅命中可执行扩展名规则）",
-      "filename": "evil.iso",
-      "size": 32775
-    },
-    {
-      "category": "CHM帮助",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ChmWithScript"
-      ],
-      "description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
-      "filename": "evil_help.chm",
-      "size": 1691
-    },
-    {
-      "category": "Linux可执行",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "LinuxExecutable"
-      ],
-      "description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
-      "filename": "linux_malicious",
-      "size": 71
-    },
-    {
-      "category": "LOLBin",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "DangerousExecutableExtension"
-      ],
-      "description": "certutil -decode LOLBin 下载执行（当前引擎未启用 C1_PE_LOLBin_Usage，仅命中可执行扩展名规则）",
-      "filename": "lolbin.cmd",
-      "size": 114
-    },
-    {
-      "category": "Office宏",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "VBAAutoExecShell",
-        "VBAAutoExec"
-      ],
-      "description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
-      "filename": "macro_alert.docm",
-      "size": 2586
-    },
-    {
-      "category": "Linux后门",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "DesktopFileAutoExec"
-      ],
-      "description": ".desktop 文件恶意 Exec 字段",
-      "filename": "malicious.desktop",
-      "size": 114
-    },
-    {
-      "category": "PDF载荷",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "PdfJavaScript",
-        "PdfOpenAction"
-      ],
-      "description": "PDF /OpenAction /JS app.launchURL 自动执行",
-      "filename": "malicious.pdf",
-      "size": 534
-    },
-    {
-      "category": "挖矿",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "C7_Linux_Miner_Generic"
-      ],
-      "description": "XMRig stratum+tcp 矿池配置（规则命中但权重不够未达 reject 阈值）",
-      "filename": "miner_config.json",
-      "size": 123
-    },
-    {
-      "category": "阴性对照",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常 PDF（只有简单文本，无 JS/自动执行）",
-      "filename": "normal.pdf",
-      "size": 439
-    },
-    {
-      "category": "阴性对照",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "DangerousExecutableExtension"
-      ],
-      "description": "正常部署 Shell（引擎 .sh 扩展名触发 DangerousExecutableExtension，属零容忍范围）",
-      "filename": "normal_deploy.sh",
-      "size": 155
-    },
-    {
-      "category": "阴性对照",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常纯文本文件",
-      "filename": "normal_readme.txt",
-      "size": 162
-    },
-    {
-      "category": "阴性对照",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常 Word 文档（无宏、无外链）",
-      "filename": "normal_report.docx",
-      "size": 1212
-    },
-    {
-      "category": "OLE嵌入",
+      "filename": "L0-001_jpg_normal.jpg",
+      "case_id": "L0-001",
+      "category": "L0",
       "expected_verdict": "pass",
       "expected_rules": [
-        "OleToolsUnavailable"
+        "identify_type"
       ],
-      "description": "DOC 文件内嵌 .exe OLE 对象（OleTools 模块未加载 → clean，规则返回 OleToolsUnavailable 零权重）",
-      "filename": "ole_dropper.doc",
-      "size": 1641
+      "description": "正常文件幻数识别-JPG"
     },
     {
-      "category": "PE恶意程序",
+      "filename": "L0-002_png_normal.png",
+      "case_id": "L0-002",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "identify_type"
+      ],
+      "description": "正常文件幻数识别-PNG"
+    },
+    {
+      "filename": "L0-003_docx_normal.docx",
+      "case_id": "L0-003",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "identify_type"
+      ],
+      "description": "正常文件幻数识别-DOCX"
+    },
+    {
+      "filename": "L0-004_pdf_normal.pdf",
+      "case_id": "L0-004",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "identify_type"
+      ],
+      "description": "正常文件幻数识别-PDF"
+    },
+    {
+      "filename": "L0-005_pe_clean.exe",
+      "case_id": "L0-005",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExtension",
+        "UnsignedExecutable"
+      ],
+      "description": "正常文件幻数识别-干净PE"
+    },
+    {
+      "filename": "L0-006_disguise_jpg_pe.jpg",
+      "case_id": "L0-006",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "C1_PE_Downloader_Loader"
+        "ExtensionMismatch"
       ],
-      "description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
-      "filename": "pe_downloader.exe",
-      "size": 1148
+      "description": "jpg 后缀 + 实际 PE MZ 头"
     },
     {
-      "category": "PE恶意程序",
+      "filename": "L0-007_disguise_txt_pdf.txt",
+      "case_id": "L0-007",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "C1_PE_ProcessInjection"
+        "ExtensionMismatch"
       ],
-      "description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
-      "filename": "pe_injection.exe",
-      "size": 1129
+      "description": "后缀伪装：txt后缀，实际PDF幻数"
     },
     {
-      "category": "持久化",
+      "filename": "L0-008_disguise_png_zip.png",
+      "case_id": "L0-008",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "C7_Linux_Persistence_Crontab"
+        "ExtensionMismatch"
       ],
-      "description": "crontab 注入 wget/curl 下载执行",
-      "filename": "persist_cron.sh",
-      "size": 95
+      "description": "后缀伪装：png后缀，实际ZIP幻数"
     },
     {
-      "category": "钓鱼邮件",
+      "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
+      "case_id": "L0-009",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "EmailAttachmentDangerous",
-        "EmailAttachmentDisguised",
-        "EmailAttachmentWebshell",
-        "EmailPhishingKeyword"
+        "DoubleExtension",
+        "DangerousExtension"
       ],
-      "description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
-      "filename": "phishing.eml",
-      "size": 1869
+      "description": "双扩展名伪装：report.pdf.exe"
     },
     {
-      "category": "伪装",
+      "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
+      "case_id": "L0-010",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "DangerousExecutableExtension"
+        "DoubleExtension",
+        "DangerousExtension"
       ],
-      "description": "双扩展名伪装 .jpg.php（当前引擎未启用 DoubleExtension，命中 DangerousExecutableExtension 拒绝）",
-      "filename": "photo.jpg.php",
-      "size": 29
+      "description": "双扩展名伪装：data.txt.ps1"
     },
     {
-      "category": "勒索",
+      "filename": "L0-011_double_ext_docx_js.docx.js",
+      "case_id": "L0-011",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "C8_Ransomware_Encryption"
+        "DoubleExtension",
+        "DangerousExtension"
       ],
-      "description": "加密 API + 卷影删除 + 勒索信文件名",
-      "filename": "ransom_dropper.exe.txt",
-      "size": 215
+      "description": "双扩展名伪装：note.docx.js"
     },
     {
-      "category": "加密Office",
+      "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
+      "case_id": "L0-012",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
-        "OfficeEncrypted"
+        "DoubleExtension",
+        "DangerousExtension"
       ],
-      "description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
-      "filename": "sealed.docx",
-      "size": 6656
+      "description": "双扩展名伪装：log.xlsx.bat"
     },
     {
-      "category": "加密Office",
-      "expected_verdict": "reject",
+      "filename": "L0-013_clean.ps1",
+      "case_id": "L0-013",
+      "category": "L0",
+      "expected_verdict": "review",
       "expected_rules": [
-        "OfficeEncrypted"
+        "DangerousExtension"
       ],
-      "description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
-      "filename": "sealed.xlsx",
-      "size": 6656
+      "description": "干净 ps1 文件"
     },
     {
-      "category": "Webshell",
-      "expected_verdict": "reject",
+      "filename": "L0-014_clean.bat",
+      "case_id": "L0-014",
+      "category": "L0",
+      "expected_verdict": "review",
       "expected_rules": [
-        "DangerousExecutableExtension"
+        "DangerousExtension"
       ],
-      "description": "ASP.NET Process.Start 命令执行（当前引擎未启用 C3_Webshell_ASPNET，命中 DangerousExecutableExtension 拒绝）",
-      "filename": "shell_aspx.aspx",
-      "size": 169
+      "description": "干净 bat 文件"
     },
     {
-      "category": "Linux后门",
-      "expected_verdict": "reject",
+      "filename": "L0-015_clean.cmd",
+      "case_id": "L0-015",
+      "category": "L0",
+      "expected_verdict": "review",
       "expected_rules": [
-        "ShellScriptDangerous",
-        "C7_Linux_ReverseShell_Bash"
+        "DangerousExtension"
       ],
-      "description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
-      "filename": "shell_bash_devtcp.sh",
-      "size": 51
+      "description": "干净 cmd 文件"
     },
     {
-      "category": "Webshell",
-      "expected_verdict": "reject",
+      "filename": "L0-016_clean.vbs",
+      "case_id": "L0-016",
+      "category": "L0",
+      "expected_verdict": "review",
       "expected_rules": [
-        "C3_JSP_Webshell_RuntimeExec"
+        "DangerousExtension"
       ],
-      "description": "JSP Runtime.getRuntime().exec 命令执行",
-      "filename": "shell_jsp_runtime.jsp",
-      "size": 316
+      "description": "干净 vbs 文件"
     },
     {
-      "category": "Linux后门",
-      "expected_verdict": "reject",
+      "filename": "L0-017_clean.js",
+      "case_id": "L0-017",
+      "category": "L0",
+      "expected_verdict": "review",
       "expected_rules": [
-        "ShellScriptDangerous",
-        "C7_Linux_ReverseShell_NC"
+        "DangerousExtension"
       ],
-      "description": "nc -e /bin/bash 反弹 Shell",
-      "filename": "shell_nc.sh",
-      "size": 42
+      "description": "干净 js 文件"
     },
     {
-      "category": "Webshell",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "C3_PHP_Webshell_Oneliner"
-      ],
-      "description": "PHP oneliner eval + echo 组合",
-      "filename": "shell_php_eval.php",
-      "size": 40
-    },
-    {
-      "category": "Webshell",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "C3_PHP_Webshell_Obfuscated"
-      ],
-      "description": "PHP base64 + assert 混淆",
-      "filename": "shell_php_obf.php",
-      "size": 61
-    },
-    {
-      "category": "Linux后门",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "DangerousExecutableExtension"
-      ],
-      "description": "Python pty + socket 反弹 Shell（当前引擎未启用 ShellScriptDangerous / C7_Linux_ReverseShell_Python，命中 .py 可执行扩展名）",
-      "filename": "shell_python.py",
-      "size": 211
-    },
-    {
-      "category": "LNK",
-      "expected_verdict": "suspicious",
-      "expected_rules": [
-        "DangerousExecutableExtension"
-      ],
-      "description": "LNK Shell Link 指向 cmd.exe /c 下载执行（当前引擎未启用 LnkWithAutoExec，命中 .lnk 可执行扩展名）",
-      "filename": "shortcut.lnk",
-      "size": 143
-    },
-    {
-      "category": "Office宏",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "AttachedTemplate"
-      ],
-      "description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
-      "filename": "template_backdoor.docx",
-      "size": 2176
-    },
-    {
-      "category": "Office宏",
-      "expected_verdict": "malicious",
-      "expected_rules": [
-        "VBAAutoExecShell"
-      ],
-      "description": "VBA AutoOpen + Shell 执行（规则名带 Shell 后缀，比原预期 VBAAutoExec 更精确）",
-      "filename": "vba_autoexec.bas",
-      "size": 98
-    },
-    {
-      "category": "WPS宏",
-      "expected_verdict": "malicious",
-      "expected_rules": [
-        "C7_Linux_ReverseShell_Bash",
-        "C7_Linux_ReverseShell_Misc",
-        "DangerousExecutableExtension"
-      ],
-      "description": "WPS Linux JS 宏 AutoOpen + /bin/sh（YARA 反弹 Shell 规则命中 + .js 扩展名；未命中宏规则 VBAAutoExecShell）",
-      "filename": "wps_macro.js",
-      "size": 142
-    },
-    {
-      "category": "攻击载体",
+      "filename": "L0-018_zip_traversal.zip",
+      "case_id": "L0-018",
+      "category": "L0",
       "expected_verdict": "reject",
       "expected_rules": [
         "PathTraversal"
       ],
-      "description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
-      "filename": "zip_traversal.zip",
-      "size": 164
+      "description": "ZIP单级路径穿越：../test.txt"
+    },
+    {
+      "filename": "L0-019_zip_deep_traversal.zip",
+      "case_id": "L0-019",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal"
+      ],
+      "description": "ZIP多级路径穿越：../../a.txt"
+    },
+    {
+      "filename": "L0-020_zip_bomb.zip",
+      "case_id": "L0-020",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveBombSuspect"
+      ],
+      "description": "ZIP炸弹42.zip"
+    },
+    {
+      "filename": "L0-022_3layer_nested.zip",
+      "case_id": "L0-022",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "recursive_ok"
+      ],
+      "description": "3层无害嵌套ZIP"
+    },
+    {
+      "filename": "L0-024_encrypted.zip",
+      "case_id": "L0-024",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "EncryptedArchive"
+      ],
+      "description": "加密 ZIP（标记待验证）"
+    },
+    {
+      "filename": "L0-025_corrupt_zip.zip",
+      "case_id": "L0-025",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ArchiveBroken"
+      ],
+      "description": "截断损坏 ZIP 头"
+    },
+    {
+      "filename": "L0-026_corrupt_direntry.zip",
+      "case_id": "L0-026",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ArchiveBroken"
+      ],
+      "description": "损坏ZIP目录项"
+    },
+    {
+      "filename": "L0-029_zero_byte_exe.exe",
+      "case_id": "L0-029",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ZeroByteFile",
+        "DangerousExtension"
+      ],
+      "description": "空文件（0字节）后缀exe"
+    },
+    {
+      "filename": "L1-001_eicar.txt",
+      "case_id": "L1-001",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "EICAR标准测试串文本"
+    },
+    {
+      "filename": "L1-002_eicar_in_zip.zip",
+      "case_id": "L1-002",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "EICAR放入zip压缩包"
+    },
+    {
+      "filename": "L1-004_eicar_in_docx.docx",
+      "case_id": "L1-004",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "EICAR放入docx内嵌（OLE）"
+    },
+    {
+      "filename": "L1-005_eicar_modified.txt",
+      "case_id": "L1-005",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "修改 1 字节 EICAR，ClamAV 不应命中"
+    },
+    {
+      "filename": "L0-001_jpg_normal.jpg",
+      "case_id": "L1-006",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净jpg图片（对照负样本）"
+    },
+    {
+      "filename": "L0-003_docx_normal.docx",
+      "case_id": "L1-007",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净docx文档（对照负样本）"
+    },
+    {
+      "filename": "L0-005_pe_clean.exe",
+      "case_id": "L1-008",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净hello PE（对照负样本）"
+    },
+    {
+      "filename": "L1-011_eicar_in_3layer.zip",
+      "case_id": "L1-011",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "EICAR放在多层嵌套zip"
+    },
+    {
+      "filename": "L1-012_eicar_base64.txt",
+      "case_id": "L1-012",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "base64 编码 EICAR，ClamAV 不解码"
+    },
+    {
+      "filename": "L3-001_001_sample.ps1",
+      "case_id": "L3-001",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "PS1明文：Invoke-WebRequest下载"
+    },
+    {
+      "filename": "L3-002_002_sample.ps1",
+      "case_id": "L3-002",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ReverseShellNetcat"
+      ],
+      "description": "PS1明文：反弹shell nc"
+    },
+    {
+      "filename": "L3-003_003_sample.bat",
+      "case_id": "L3-003",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadUnix"
+      ],
+      "description": "bat明文：curl下载payload"
+    },
+    {
+      "filename": "L3-004_004_sample.txt",
+      "case_id": "L3-004",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "CredentialStealer"
+      ],
+      "description": "文本包含mimikatz关键字"
+    },
+    {
+      "filename": "L3-005_005_sample.txt",
+      "case_id": "L3-005",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "CredentialExport"
+      ],
+      "description": "文本包含reg save导出注册表"
+    },
+    {
+      "filename": "L3-006_006_sample.txt",
+      "case_id": "L3-006",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteSessionHijack"
+      ],
+      "description": "文本包含rdp、tscon劫持关键字"
+    },
+    {
+      "filename": "L3-007_007_sample.txt",
+      "case_id": "L3-007",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "高危串base64编码放在txt"
+    },
+    {
+      "filename": "L3-008_008_sample.ps1",
+      "case_id": "L3-008",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "Powershell字符串拆分拼接绕过"
+    },
+    {
+      "filename": "L3-010_010_sample.ps1",
+      "case_id": "L3-010",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "高危串插入注释分割（powershell #注释）"
+    },
+    {
+      "filename": "L3-011_011_sample.js",
+      "case_id": "L3-011",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadUnix"
+      ],
+      "description": "高危串放js脚本内"
+    },
+    {
+      "filename": "L3-012_012_sample.bat",
+      "case_id": "L3-012",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "pass（内网白名单对照）"
+      ],
+      "description": "正常内网运维curl（白名单对照）"
+    },
+    {
+      "filename": "L3-016_016_sample.ps1",
+      "case_id": "L3-016",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "空脚本文件（负样本）"
+    },
+    {
+      "filename": "L3-017_017_sample.txt",
+      "case_id": "L3-017",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ReverseShellNetcat",
+        "CredentialStealer"
+      ],
+      "description": "多条高危特征同文件复合"
+    },
+    {
+      "filename": "L3-018_018_sample.txt",
+      "case_id": "L3-018",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串大小写混写"
+    },
+    {
+      "filename": "L3-021_021_sample.eml",
+      "case_id": "L3-021",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在eml邮件正文"
+    },
+    {
+      "filename": "L3-024_024_sample.txt",
+      "case_id": "L3-024",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "超长单行文本（10万字符）包含高危串"
+    },
+    {
+      "filename": "L3-014_l3001_in_zip.zip",
+      "case_id": "L3-014",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在zip内部txt"
+    },
+    {
+      "filename": "L3-015_keyword_in_docx.docx",
+      "case_id": "L3-015",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在docx文本正文"
+    },
+    {
+      "filename": "L3-019_unicode_obfuscated.txt",
+      "case_id": "L3-019",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "同形字混淆，L3 默认不命中"
+    },
+    {
+      "filename": "L3-020_log_with_keyword.log",
+      "case_id": "L3-020",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ReverseShellNetcat"
+      ],
+      "description": "日志文件混杂正常日志+高危串"
+    },
+    {
+      "filename": "L3-023_keyword_in_encrypted.zip",
+      "case_id": "L3-023",
+      "category": "L3",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "加密 zip 内容无法扫描（标记）"
+    },
+    {
+      "filename": "L4-001_001_sample.txt",
+      "case_id": "L4-001",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "YARA正向命中占位（需对应规则）"
+    },
+    {
+      "filename": "L4-002_002_sample.txt",
+      "case_id": "L4-002",
+      "category": "L4",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净对照"
+    },
+    {
+      "filename": "L4-005_005_sample.txt",
+      "case_id": "L4-005",
+      "category": "L4",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "热加载测试占位"
+    },
+    {
+      "filename": "L4-008_in_zip.zip",
+      "case_id": "L4-008",
+      "category": "L4",
+      "expected_verdict": null,
+      "expected_rules": [],
+      "description": "压缩包内文件匹配YARA规则"
+    },
+    {
+      "filename": "L4-010_010_sample.txt",
+      "case_id": "L4-010",
+      "category": "L4",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "正则 YARA 测试占位"
+    },
+    {
+      "filename": "L5-001_clean_hello.exe",
+      "case_id": "L5-001",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "原生干净HelloWorld PE（无壳）"
+    },
+    {
+      "filename": "L5-002_upx_shell.exe",
+      "case_id": "L5-002",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "UPXPackerDetected",
+        "HighEntropySection"
+      ],
+      "description": "UPX0/UPX1 节名"
+    },
+    {
+      "filename": "L5-003_double_upx.exe",
+      "case_id": "L5-003",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "UPXPackerDetected"
+      ],
+      "description": "UPX加壳PE，二次压缩"
+    },
+    {
+      "filename": "L5-004_rwx_section.exe",
+      "case_id": "L5-004",
+      "category": "L5",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RWXSectionDetected"
+      ],
+      "description": "节属性 RWX"
+    },
+    {
+      "filename": "L5-007_garbage_section.exe",
+      "case_id": "L5-007",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "AbnormalSectionName"
+      ],
+      "description": "节名乱码"
+    },
+    {
+      "filename": "L5-010_bad_mz.exe",
+      "case_id": "L5-010",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "PE 头非法"
+    },
+    {
+      "filename": "L5-011_truncated.exe",
+      "case_id": "L5-011",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "截断 PE"
+    },
+    {
+      "filename": "L5-012_pe32.exe",
+      "case_id": "L5-012",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "PEArchInfo"
+      ],
+      "description": "32 位识别"
+    },
+    {
+      "filename": "L5-013_pe64.exe",
+      "case_id": "L5-013",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "PEArchInfo"
+      ],
+      "description": "64 位识别占位"
+    },
+    {
+      "filename": "L5-014_clean_tool.exe",
+      "case_id": "L5-014",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "PE导入表大量系统API（正常工具）"
+    },
+    {
+      "filename": "L5-016_zero_section.exe",
+      "case_id": "L5-016",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "零节 PE 占位"
+    },
+    {
+      "filename": "L5-017_upx_rwx.exe",
+      "case_id": "L5-017",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "UPXPackerDetected",
+        "RWXSectionDetected"
+      ],
+      "description": "UPX壳 + RWX节复合特征"
+    },
+    {
+      "filename": "L5-018_debug_info.exe",
+      "case_id": "L5-018",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DebugInformationPresent"
+      ],
+      "description": "调试信息占位"
+    },
+    {
+      "filename": "NEG-001_clean.jpg",
+      "case_id": "NEG-001",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务标准JPG图片"
+    },
+    {
+      "filename": "NEG-002_clean.png",
+      "case_id": "NEG-002",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务PNG图片"
+    },
+    {
+      "filename": "NEG-003_clean.mp4",
+      "case_id": "NEG-003",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务MP4视频"
+    },
+    {
+      "filename": "NEG-004_clean.docx",
+      "case_id": "NEG-004",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务正常docx报表"
+    },
+    {
+      "filename": "NEG-005_clean.xlsx",
+      "case_id": "NEG-005",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务正常xlsx表格"
+    },
+    {
+      "filename": "NEG-006_clean.pdf",
+      "case_id": "NEG-006",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务正常PDF报告"
+    },
+    {
+      "filename": "NEG-007_clean.java",
+      "case_id": "NEG-007",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务源码java文件"
+    },
+    {
+      "filename": "NEG-008_clean.py",
+      "case_id": "NEG-008",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务源码python脚本"
+    },
+    {
+      "filename": "NEG-009_clean.zip",
+      "case_id": "NEG-009",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常业务压缩包zip"
+    },
+    {
+      "filename": "NEG-010_clean.exe",
+      "case_id": "NEG-010",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常业务安装包（干净开源）"
+    },
+    {
+      "filename": "NEG-011_clean.log",
+      "case_id": "NEG-011",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常日志文件"
+    },
+    {
+      "filename": "NEG-012_clean.csv",
+      "case_id": "NEG-012",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常csv业务数据文件"
+    },
+    {
+      "filename": "NEG-013_clean.eml",
+      "case_id": "NEG-013",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常eml业务邮件（无附件、无外联恶意）"
+    },
+    {
+      "filename": "NEG-014_clean.dll",
+      "case_id": "NEG-014",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常dll（系统干净dll）"
+    },
+    {
+      "filename": "NEG-015_clean.ttf",
+      "case_id": "NEG-015",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常字体文件ttf"
+    },
+    {
+      "filename": "NEG-016_clean.dwg",
+      "case_id": "NEG-016",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常CAD图纸"
+    },
+    {
+      "filename": "NEG-017_4layer_nested.zip",
+      "case_id": "NEG-017",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "多层嵌套干净zip（无风险）"
+    },
+    {
+      "filename": "NEG-018_clean.bat",
+      "case_id": "NEG-018",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常bat运维脚本（内网备份）"
+    },
+    {
+      "filename": "NEG-019_clean.ps1",
+      "case_id": "NEG-019",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常ps1运维脚本（内网查询）"
+    },
+    {
+      "filename": "NEG-020_clean.odt",
+      "case_id": "NEG-020",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常odt文档"
+    },
+    {
+      "filename": "L0-021_small_bomb.zip",
+      "case_id": "L0-021",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveBombSuspect"
+      ],
+      "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）"
+    },
+    {
+      "filename": "L0-023_5layer_nested.zip",
+      "case_id": "L0-023",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "recursive_ok"
+      ],
+      "description": "5 层无害嵌套 ZIP"
+    },
+    {
+      "filename": "L0-027_long_filename.zip",
+      "case_id": "L0-027",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "压缩包内 200 字符超长文件名"
+    },
+    {
+      "filename": "L0-028_unicode_filename.zip",
+      "case_id": "L0-028",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "unicode/emoji 文件名"
+    },
+    {
+      "filename": "L0-030_nested_traversal.zip",
+      "case_id": "L0-030",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal"
+      ],
+      "description": "嵌套 zip 内含穿越条目"
+    },
+    {
+      "filename": "L1-003_eicar_in_encrypted.zip",
+      "case_id": "L1-003",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "EncryptedArchive"
+      ],
+      "description": "加密 ZIP（占位：实际加密需 7z/zip -P）"
+    },
+    {
+      "filename": "L1-009_minimal.cvd",
+      "case_id": "L1-009",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "热加载测试占位（需真实 .cvd 文件）"
+    },
+    {
+      "filename": "L1-010_corrupt.cvd",
+      "case_id": "L1-010",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "损坏病毒库占位"
+    },
+    {
+      "filename": "L1-013_bigfile_eicar.txt",
+      "case_id": "L1-013",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "10MB+ 文本尾部含 EICAR"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_00.txt",
+      "case_id": "L1-014-00",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #0"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_01.txt",
+      "case_id": "L1-014-01",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #1"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_02.txt",
+      "case_id": "L1-014-02",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #2"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_03.txt",
+      "case_id": "L1-014-03",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #3"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_04.txt",
+      "case_id": "L1-014-04",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #4"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_05.txt",
+      "case_id": "L1-014-05",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #5"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_06.txt",
+      "case_id": "L1-014-06",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #6"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_07.txt",
+      "case_id": "L1-014-07",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #7"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_08.txt",
+      "case_id": "L1-014-08",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #8"
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_09.txt",
+      "case_id": "L1-014-09",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "并发压测占位 #9"
+    },
+    {
+      "filename": "L1-014_concurrent_test.txt",
+      "case_id": "L1-014",
+      "category": "L1",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "并发压测占位（靠 API 并发调用）"
+    },
+    {
+      "filename": "L1-015_layer_off_sample.bin",
+      "case_id": "L1-015",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ClamAV:EICAR"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L3-022_layer_off_sample.bin",
+      "case_id": "L3-022",
+      "category": "L3",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L4-014_layer_off_sample.bin",
+      "case_id": "L4-014",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L5-020_layer_off_sample.bin",
+      "case_id": "L5-020",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "RWXSectionDetected"
+      ],
+      "description": "关闭分层开关测试占位"
+    },
+    {
+      "filename": "L3-009_newline_split.txt",
+      "case_id": "L3-009",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "换行分割绕过（L3 不做换行合并，记录边界）"
+    },
+    {
+      "filename": "L3-013_normal_scp.sh",
+      "case_id": "L3-013",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "内网正常 scp 运维脚本，不误报"
+    },
+    {
+      "filename": "L3-025_whitelist_test.txt",
+      "case_id": "L3-025",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "内网白名单域名对照（策略层白名单）"
+    },
+    {
+      "filename": "L4-003_pe_with_string.exe",
+      "case_id": "L4-003",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "二进制内嵌匹配字符串"
+    },
+    {
+      "filename": "L4-004_multi_rule_match.txt",
+      "case_id": "L4-004",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "同一个文件同时命中多条 YARA"
+    },
+    {
+      "filename": "L4-006_bad_syntax_rule.yar",
+      "case_id": "L4-006",
+      "category": "L4",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "语法错误 YARA 规则文件（输入给规则目录）"
+    },
+    {
+      "filename": "L4-007_meta_rule_match.txt",
+      "case_id": "L4-007",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "带 meta 的 YARA 规则匹配"
+    },
+    {
+      "filename": "L4-009_yara_in_encrypted.zip",
+      "case_id": "L4-009",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "加密 zip 内 YARA 样本"
+    },
+    {
+      "filename": "L4-011_count_condition.txt",
+      "case_id": "L4-011",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "YARA count > 3 条件"
+    },
+    {
+      "filename": "L4-012_size_condition.bin",
+      "case_id": "L4-012",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "YARA 文件大小条件"
+    },
+    {
+      "filename": "L4-013_bigfile_yara.txt",
+      "case_id": "L4-013",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "YARA"
+      ],
+      "description": "100MB 文件 YARA 扫描"
+    },
+    {
+      "filename": "L4-015_hash_whitelist.txt",
+      "case_id": "L4-015",
+      "category": "L4",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "MD5 在白名单"
+    },
+    {
+      "filename": "L5-005_injection_imports.exe",
+      "case_id": "L5-005",
+      "category": "L5",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "SuspiciousImports"
+      ],
+      "description": "注入组合导入（需要真实 pefile 引入 API）"
+    },
+    {
+      "filename": "L5-006_single_virtualalloc.exe",
+      "case_id": "L5-006",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "SuspiciousImports"
+      ],
+      "description": "单一可疑内存 API"
+    },
+    {
+      "filename": "L5-008_many_exports.exe",
+      "case_id": "L5-008",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "导出表异常（需真实工具生成）"
+    },
+    {
+      "filename": "L5-009_shell_in_resource.exe",
+      "case_id": "L5-009",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "资源段内嵌字符串（占位）"
+    },
+    {
+      "filename": "L5-015_bad_reloc.exe",
+      "case_id": "L5-015",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "重定位表损坏占位"
+    },
+    {
+      "filename": "L5-016_zero_sections.exe",
+      "case_id": "L5-016",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "PeParseFailed"
+      ],
+      "description": "无节表最小 PE"
+    },
+    {
+      "filename": "L5-019_200mb_huge.exe",
+      "case_id": "L5-019",
+      "category": "L5",
+      "expected_verdict": "unknown",
+      "expected_rules": [],
+      "description": "200MB 超大 PE（占位，真实生成会写满磁盘）"
     }
-  ]
+  ],
+  "placeholder_generated_at": "2026-10-29T11:36:17.181303"
 }
\ No newline at end of file
diff --git a/tests/samples/index.json b/tests/samples/index.json
index 1fae5a6..68456ca 100644
--- a/tests/samples/index.json
+++ b/tests/samples/index.json
@@ -1,1271 +1,2218 @@
-{
-  "meshsafe_target_version": "v0.2.1",
-  "generated_at": "2026-10-29T11:32:38.543046",
-  "csv_source": "用例.csv",
-  "samples": [
-    {
-      "filename": "L0-001_jpg_normal.jpg",
-      "case_id": "L0-001",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "identify_type"
-      ],
-      "description": "正常文件幻数识别-JPG"
-    },
-    {
-      "filename": "L0-002_png_normal.png",
-      "case_id": "L0-002",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "identify_type"
-      ],
-      "description": "正常文件幻数识别-PNG"
-    },
-    {
-      "filename": "L0-003_docx_normal.docx",
-      "case_id": "L0-003",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "identify_type"
-      ],
-      "description": "正常文件幻数识别-DOCX"
-    },
-    {
-      "filename": "L0-004_pdf_normal.pdf",
-      "case_id": "L0-004",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "identify_type"
-      ],
-      "description": "正常文件幻数识别-PDF"
-    },
-    {
-      "filename": "L0-005_pe_clean.exe",
-      "case_id": "L0-005",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension",
-        "UnsignedExecutable"
-      ],
-      "description": "正常文件幻数识别-干净PE"
-    },
-    {
-      "filename": "L0-006_disguise_jpg_pe.jpg",
-      "case_id": "L0-006",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ExtensionMismatch"
-      ],
-      "description": "jpg 后缀 + 实际 PE MZ 头"
-    },
-    {
-      "filename": "L0-007_disguise_txt_pdf.txt",
-      "case_id": "L0-007",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ExtensionMismatch"
-      ],
-      "description": "后缀伪装：txt后缀，实际PDF幻数"
-    },
-    {
-      "filename": "L0-008_disguise_png_zip.png",
-      "case_id": "L0-008",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ExtensionMismatch"
-      ],
-      "description": "后缀伪装：png后缀，实际ZIP幻数"
-    },
-    {
-      "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
-      "case_id": "L0-009",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "DoubleExtension",
-        "DangerousExtension"
-      ],
-      "description": "双扩展名伪装：report.pdf.exe"
-    },
-    {
-      "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
-      "case_id": "L0-010",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "DoubleExtension",
-        "DangerousExtension"
-      ],
-      "description": "双扩展名伪装：data.txt.ps1"
-    },
-    {
-      "filename": "L0-011_double_ext_docx_js.docx.js",
-      "case_id": "L0-011",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "DoubleExtension",
-        "DangerousExtension"
-      ],
-      "description": "双扩展名伪装：note.docx.js"
-    },
-    {
-      "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
-      "case_id": "L0-012",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "DoubleExtension",
-        "DangerousExtension"
-      ],
-      "description": "双扩展名伪装：log.xlsx.bat"
-    },
-    {
-      "filename": "L0-013_clean.ps1",
-      "case_id": "L0-013",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension"
-      ],
-      "description": "干净 ps1 文件"
-    },
-    {
-      "filename": "L0-014_clean.bat",
-      "case_id": "L0-014",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension"
-      ],
-      "description": "干净 bat 文件"
-    },
-    {
-      "filename": "L0-015_clean.cmd",
-      "case_id": "L0-015",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension"
-      ],
-      "description": "干净 cmd 文件"
-    },
-    {
-      "filename": "L0-016_clean.vbs",
-      "case_id": "L0-016",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension"
-      ],
-      "description": "干净 vbs 文件"
-    },
-    {
-      "filename": "L0-017_clean.js",
-      "case_id": "L0-017",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DangerousExtension"
-      ],
-      "description": "干净 js 文件"
-    },
-    {
-      "filename": "L0-018_zip_traversal.zip",
-      "case_id": "L0-018",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "PathTraversal"
-      ],
-      "description": "ZIP单级路径穿越：../test.txt"
-    },
-    {
-      "filename": "L0-019_zip_deep_traversal.zip",
-      "case_id": "L0-019",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "PathTraversal"
-      ],
-      "description": "ZIP多级路径穿越：../../a.txt"
-    },
-    {
-      "filename": "L0-020_zip_bomb.zip",
-      "case_id": "L0-020",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ArchiveBombSuspect"
-      ],
-      "description": "ZIP炸弹42.zip"
-    },
-    {
-      "filename": "L0-022_3layer_nested.zip",
-      "case_id": "L0-022",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "recursive_ok"
-      ],
-      "description": "3层无害嵌套ZIP"
-    },
-    {
-      "filename": "L0-024_encrypted.zip",
-      "case_id": "L0-024",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "EncryptedArchive"
-      ],
-      "description": "加密 ZIP（标记待验证）"
-    },
-    {
-      "filename": "L0-025_corrupt_zip.zip",
-      "case_id": "L0-025",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "ArchiveBroken"
-      ],
-      "description": "截断损坏 ZIP 头"
-    },
-    {
-      "filename": "L0-026_corrupt_direntry.zip",
-      "case_id": "L0-026",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "ArchiveBroken"
-      ],
-      "description": "损坏ZIP目录项"
-    },
-    {
-      "filename": "L0-029_zero_byte_exe.exe",
-      "case_id": "L0-029",
-      "category": "L0",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "ZeroByteFile",
-        "DangerousExtension"
-      ],
-      "description": "空文件（0字节）后缀exe"
-    },
-    {
-      "filename": "L1-001_eicar.txt",
-      "case_id": "L1-001",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "EICAR标准测试串文本"
-    },
-    {
-      "filename": "L1-002_eicar_in_zip.zip",
-      "case_id": "L1-002",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "EICAR放入zip压缩包"
-    },
-    {
-      "filename": "L1-004_eicar_in_docx.docx",
-      "case_id": "L1-004",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "EICAR放入docx内嵌（OLE）"
-    },
-    {
-      "filename": "L1-005_eicar_modified.txt",
-      "case_id": "L1-005",
-      "category": "L1",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "修改 1 字节 EICAR，ClamAV 不应命中"
-    },
-    {
-      "filename": "L0-001_jpg_normal.jpg",
-      "case_id": "L1-006",
-      "category": "L1",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "干净jpg图片（对照负样本）"
-    },
-    {
-      "filename": "L0-003_docx_normal.docx",
-      "case_id": "L1-007",
-      "category": "L1",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "干净docx文档（对照负样本）"
-    },
-    {
-      "filename": "L0-005_pe_clean.exe",
-      "case_id": "L1-008",
-      "category": "L1",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "干净hello PE（对照负样本）"
-    },
-    {
-      "filename": "L1-011_eicar_in_3layer.zip",
-      "case_id": "L1-011",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "EICAR放在多层嵌套zip"
-    },
-    {
-      "filename": "L1-012_eicar_base64.txt",
-      "case_id": "L1-012",
-      "category": "L1",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "base64 编码 EICAR，ClamAV 不解码"
-    },
-    {
-      "filename": "L3-001_001_sample.ps1",
-      "case_id": "L3-001",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "PS1明文：Invoke-WebRequest下载"
-    },
-    {
-      "filename": "L3-002_002_sample.ps1",
-      "case_id": "L3-002",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ReverseShellNetcat"
-      ],
-      "description": "PS1明文：反弹shell nc"
-    },
-    {
-      "filename": "L3-003_003_sample.bat",
-      "case_id": "L3-003",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadUnix"
-      ],
-      "description": "bat明文：curl下载payload"
-    },
-    {
-      "filename": "L3-004_004_sample.txt",
-      "case_id": "L3-004",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "CredentialStealer"
-      ],
-      "description": "文本包含mimikatz关键字"
-    },
-    {
-      "filename": "L3-005_005_sample.txt",
-      "case_id": "L3-005",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "CredentialExport"
-      ],
-      "description": "文本包含reg save导出注册表"
-    },
-    {
-      "filename": "L3-006_006_sample.txt",
-      "case_id": "L3-006",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteSessionHijack"
-      ],
-      "description": "文本包含rdp、tscon劫持关键字"
-    },
-    {
-      "filename": "L3-007_007_sample.txt",
-      "case_id": "L3-007",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "高危串base64编码放在txt"
-    },
-    {
-      "filename": "L3-008_008_sample.ps1",
-      "case_id": "L3-008",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "Powershell字符串拆分拼接绕过"
-    },
-    {
-      "filename": "L3-010_010_sample.ps1",
-      "case_id": "L3-010",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "高危串插入注释分割（powershell #注释）"
-    },
-    {
-      "filename": "L3-011_011_sample.js",
-      "case_id": "L3-011",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadUnix"
-      ],
-      "description": "高危串放js脚本内"
-    },
-    {
-      "filename": "L3-012_012_sample.bat",
-      "case_id": "L3-012",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "pass（内网白名单对照）"
-      ],
-      "description": "正常内网运维curl（白名单对照）"
-    },
-    {
-      "filename": "L3-016_016_sample.ps1",
-      "case_id": "L3-016",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "空脚本文件（负样本）"
-    },
-    {
-      "filename": "L3-017_017_sample.txt",
-      "case_id": "L3-017",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ReverseShellNetcat",
-        "CredentialStealer"
-      ],
-      "description": "多条高危特征同文件复合"
-    },
-    {
-      "filename": "L3-018_018_sample.txt",
-      "case_id": "L3-018",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "高危字符串大小写混写"
-    },
-    {
-      "filename": "L3-021_021_sample.eml",
-      "case_id": "L3-021",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "高危字符串放在eml邮件正文"
-    },
-    {
-      "filename": "L3-024_024_sample.txt",
-      "case_id": "L3-024",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "超长单行文本（10万字符）包含高危串"
-    },
-    {
-      "filename": "L3-014_l3001_in_zip.zip",
-      "case_id": "L3-014",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "高危字符串放在zip内部txt"
-    },
-    {
-      "filename": "L3-015_keyword_in_docx.docx",
-      "case_id": "L3-015",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "高危字符串放在docx文本正文"
-    },
-    {
-      "filename": "L3-019_unicode_obfuscated.txt",
-      "case_id": "L3-019",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "同形字混淆，L3 默认不命中"
-    },
-    {
-      "filename": "L3-020_log_with_keyword.log",
-      "case_id": "L3-020",
-      "category": "L3",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ReverseShellNetcat"
-      ],
-      "description": "日志文件混杂正常日志+高危串"
-    },
-    {
-      "filename": "L3-023_keyword_in_encrypted.zip",
-      "case_id": "L3-023",
-      "category": "L3",
-      "expected_verdict": "review",
-      "expected_rules": [],
-      "description": "加密 zip 内容无法扫描（标记）"
-    },
-    {
-      "filename": "L4-001_001_sample.txt",
-      "case_id": "L4-001",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [],
-      "description": "YARA正向命中占位（需对应规则）"
-    },
-    {
-      "filename": "L4-002_002_sample.txt",
-      "case_id": "L4-002",
-      "category": "L4",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "干净对照"
-    },
-    {
-      "filename": "L4-005_005_sample.txt",
-      "case_id": "L4-005",
-      "category": "L4",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "热加载测试占位"
-    },
-    {
-      "filename": "L4-008_in_zip.zip",
-      "case_id": "L4-008",
-      "category": "L4",
-      "expected_verdict": null,
-      "expected_rules": [],
-      "description": "压缩包内文件匹配YARA规则"
-    },
-    {
-      "filename": "L4-010_010_sample.txt",
-      "case_id": "L4-010",
-      "category": "L4",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "正则 YARA 测试占位"
-    },
-    {
-      "filename": "L5-001_clean_hello.exe",
-      "case_id": "L5-001",
-      "category": "L5",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "原生干净HelloWorld PE（无壳）"
-    },
-    {
-      "filename": "L5-002_upx_shell.exe",
-      "case_id": "L5-002",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "UPXPackerDetected",
-        "HighEntropySection"
-      ],
-      "description": "UPX0/UPX1 节名"
-    },
-    {
-      "filename": "L5-003_double_upx.exe",
-      "case_id": "L5-003",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "UPXPackerDetected"
-      ],
-      "description": "UPX加壳PE，二次压缩"
-    },
-    {
-      "filename": "L5-004_rwx_section.exe",
-      "case_id": "L5-004",
-      "category": "L5",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "RWXSectionDetected"
-      ],
-      "description": "节属性 RWX"
-    },
-    {
-      "filename": "L5-007_garbage_section.exe",
-      "case_id": "L5-007",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "AbnormalSectionName"
-      ],
-      "description": "节名乱码"
-    },
-    {
-      "filename": "L5-010_bad_mz.exe",
-      "case_id": "L5-010",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "PeParseFailed"
-      ],
-      "description": "PE 头非法"
-    },
-    {
-      "filename": "L5-011_truncated.exe",
-      "case_id": "L5-011",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "PeParseFailed"
-      ],
-      "description": "截断 PE"
-    },
-    {
-      "filename": "L5-012_pe32.exe",
-      "case_id": "L5-012",
-      "category": "L5",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "PEArchInfo"
-      ],
-      "description": "32 位识别"
-    },
-    {
-      "filename": "L5-013_pe64.exe",
-      "case_id": "L5-013",
-      "category": "L5",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "PEArchInfo"
-      ],
-      "description": "64 位识别占位"
-    },
-    {
-      "filename": "L5-014_clean_tool.exe",
-      "case_id": "L5-014",
-      "category": "L5",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "PE导入表大量系统API（正常工具）"
-    },
-    {
-      "filename": "L5-016_zero_section.exe",
-      "case_id": "L5-016",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [],
-      "description": "零节 PE 占位"
-    },
-    {
-      "filename": "L5-017_upx_rwx.exe",
-      "case_id": "L5-017",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "UPXPackerDetected",
-        "RWXSectionDetected"
-      ],
-      "description": "UPX壳 + RWX节复合特征"
-    },
-    {
-      "filename": "L5-018_debug_info.exe",
-      "case_id": "L5-018",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "DebugInformationPresent"
-      ],
-      "description": "调试信息占位"
-    },
-    {
-      "filename": "NEG-001_clean.jpg",
-      "case_id": "NEG-001",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务标准JPG图片"
-    },
-    {
-      "filename": "NEG-002_clean.png",
-      "case_id": "NEG-002",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务PNG图片"
-    },
-    {
-      "filename": "NEG-003_clean.mp4",
-      "case_id": "NEG-003",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务MP4视频"
-    },
-    {
-      "filename": "NEG-004_clean.docx",
-      "case_id": "NEG-004",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务正常docx报表"
-    },
-    {
-      "filename": "NEG-005_clean.xlsx",
-      "case_id": "NEG-005",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务正常xlsx表格"
-    },
-    {
-      "filename": "NEG-006_clean.pdf",
-      "case_id": "NEG-006",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务正常PDF报告"
-    },
-    {
-      "filename": "NEG-007_clean.java",
-      "case_id": "NEG-007",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务源码java文件"
-    },
-    {
-      "filename": "NEG-008_clean.py",
-      "case_id": "NEG-008",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "业务源码python脚本"
-    },
-    {
-      "filename": "NEG-009_clean.zip",
-      "case_id": "NEG-009",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常业务压缩包zip"
-    },
-    {
-      "filename": "NEG-010_clean.exe",
-      "case_id": "NEG-010",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常业务安装包（干净开源）"
-    },
-    {
-      "filename": "NEG-011_clean.log",
-      "case_id": "NEG-011",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常日志文件"
-    },
-    {
-      "filename": "NEG-012_clean.csv",
-      "case_id": "NEG-012",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常csv业务数据文件"
-    },
-    {
-      "filename": "NEG-013_clean.eml",
-      "case_id": "NEG-013",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常eml业务邮件（无附件、无外联恶意）"
-    },
-    {
-      "filename": "NEG-014_clean.dll",
-      "case_id": "NEG-014",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常dll（系统干净dll）"
-    },
-    {
-      "filename": "NEG-015_clean.ttf",
-      "case_id": "NEG-015",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常字体文件ttf"
-    },
-    {
-      "filename": "NEG-016_clean.dwg",
-      "case_id": "NEG-016",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常CAD图纸"
-    },
-    {
-      "filename": "NEG-017_4layer_nested.zip",
-      "case_id": "NEG-017",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "多层嵌套干净zip（无风险）"
-    },
-    {
-      "filename": "NEG-018_clean.bat",
-      "case_id": "NEG-018",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常bat运维脚本（内网备份）"
-    },
-    {
-      "filename": "NEG-019_clean.ps1",
-      "case_id": "NEG-019",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常ps1运维脚本（内网查询）"
-    },
-    {
-      "filename": "NEG-020_clean.odt",
-      "case_id": "NEG-020",
-      "category": "NEG",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "正常odt文档"
-    },
-    {
-      "filename": "L0-021_small_bomb.zip",
-      "case_id": "L0-021",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ArchiveBombSuspect"
-      ],
-      "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）"
-    },
-    {
-      "filename": "L0-023_5layer_nested.zip",
-      "case_id": "L0-023",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [
-        "recursive_ok"
-      ],
-      "description": "5 层无害嵌套 ZIP"
-    },
-    {
-      "filename": "L0-027_long_filename.zip",
-      "case_id": "L0-027",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "压缩包内 200 字符超长文件名"
-    },
-    {
-      "filename": "L0-028_unicode_filename.zip",
-      "case_id": "L0-028",
-      "category": "L0",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "unicode/emoji 文件名"
-    },
-    {
-      "filename": "L0-030_nested_traversal.zip",
-      "case_id": "L0-030",
-      "category": "L0",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "PathTraversal"
-      ],
-      "description": "嵌套 zip 内含穿越条目"
-    },
-    {
-      "filename": "L1-003_eicar_in_encrypted.zip",
-      "case_id": "L1-003",
-      "category": "L1",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "EncryptedArchive"
-      ],
-      "description": "加密 ZIP（占位：实际加密需 7z/zip -P）"
-    },
-    {
-      "filename": "L1-009_minimal.cvd",
-      "case_id": "L1-009",
-      "category": "L1",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "热加载测试占位（需真实 .cvd 文件）"
-    },
-    {
-      "filename": "L1-010_corrupt.cvd",
-      "case_id": "L1-010",
-      "category": "L1",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "损坏病毒库占位"
-    },
-    {
-      "filename": "L1-013_bigfile_eicar.txt",
-      "case_id": "L1-013",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "10MB+ 文本尾部含 EICAR"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_00.txt",
-      "case_id": "L1-014-00",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #0"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_01.txt",
-      "case_id": "L1-014-01",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #1"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_02.txt",
-      "case_id": "L1-014-02",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #2"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_03.txt",
-      "case_id": "L1-014-03",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #3"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_04.txt",
-      "case_id": "L1-014-04",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #4"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_05.txt",
-      "case_id": "L1-014-05",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #5"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_06.txt",
-      "case_id": "L1-014-06",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #6"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_07.txt",
-      "case_id": "L1-014-07",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #7"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_08.txt",
-      "case_id": "L1-014-08",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #8"
-    },
-    {
-      "filename": "L1-014_concurrent_eicar_09.txt",
-      "case_id": "L1-014-09",
-      "category": "L1",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "并发压测占位 #9"
-    },
-    {
-      "filename": "L1-014_concurrent_test.txt",
-      "case_id": "L1-014",
-      "category": "L1",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "并发压测占位（靠 API 并发调用）"
-    },
-    {
-      "filename": "L1-015_layer_off_sample.bin",
-      "case_id": "L1-015",
-      "category": "L1",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "ClamAV:EICAR"
-      ],
-      "description": "关闭分层开关测试占位"
-    },
-    {
-      "filename": "L3-022_layer_off_sample.bin",
-      "case_id": "L3-022",
-      "category": "L3",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "RemoteDownloadPowerShell"
-      ],
-      "description": "关闭分层开关测试占位"
-    },
-    {
-      "filename": "L4-014_layer_off_sample.bin",
-      "case_id": "L4-014",
-      "category": "L4",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "关闭分层开关测试占位"
-    },
-    {
-      "filename": "L5-020_layer_off_sample.bin",
-      "case_id": "L5-020",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "RWXSectionDetected"
-      ],
-      "description": "关闭分层开关测试占位"
-    },
-    {
-      "filename": "L3-009_newline_split.txt",
-      "case_id": "L3-009",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "换行分割绕过（L3 不做换行合并，记录边界）"
-    },
-    {
-      "filename": "L3-013_normal_scp.sh",
-      "case_id": "L3-013",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "内网正常 scp 运维脚本，不误报"
-    },
-    {
-      "filename": "L3-025_whitelist_test.txt",
-      "case_id": "L3-025",
-      "category": "L3",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "内网白名单域名对照（策略层白名单）"
-    },
-    {
-      "filename": "L4-003_pe_with_string.exe",
-      "case_id": "L4-003",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "二进制内嵌匹配字符串"
-    },
-    {
-      "filename": "L4-004_multi_rule_match.txt",
-      "case_id": "L4-004",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "同一个文件同时命中多条 YARA"
-    },
-    {
-      "filename": "L4-006_bad_syntax_rule.yar",
-      "case_id": "L4-006",
-      "category": "L4",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "语法错误 YARA 规则文件（输入给规则目录）"
-    },
-    {
-      "filename": "L4-007_meta_rule_match.txt",
-      "case_id": "L4-007",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "带 meta 的 YARA 规则匹配"
-    },
-    {
-      "filename": "L4-009_yara_in_encrypted.zip",
-      "case_id": "L4-009",
-      "category": "L4",
-      "expected_verdict": "review",
-      "expected_rules": [],
-      "description": "加密 zip 内 YARA 样本"
-    },
-    {
-      "filename": "L4-011_count_condition.txt",
-      "case_id": "L4-011",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "YARA count > 3 条件"
-    },
-    {
-      "filename": "L4-012_size_condition.bin",
-      "case_id": "L4-012",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "YARA 文件大小条件"
-    },
-    {
-      "filename": "L4-013_bigfile_yara.txt",
-      "case_id": "L4-013",
-      "category": "L4",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "YARA"
-      ],
-      "description": "100MB 文件 YARA 扫描"
-    },
-    {
-      "filename": "L4-015_hash_whitelist.txt",
-      "case_id": "L4-015",
-      "category": "L4",
-      "expected_verdict": "pass",
-      "expected_rules": [],
-      "description": "MD5 在白名单"
-    },
-    {
-      "filename": "L5-005_injection_imports.exe",
-      "case_id": "L5-005",
-      "category": "L5",
-      "expected_verdict": "reject",
-      "expected_rules": [
-        "SuspiciousImports"
-      ],
-      "description": "注入组合导入（需要真实 pefile 引入 API）"
-    },
-    {
-      "filename": "L5-006_single_virtualalloc.exe",
-      "case_id": "L5-006",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "SuspiciousImports"
-      ],
-      "description": "单一可疑内存 API"
-    },
-    {
-      "filename": "L5-008_many_exports.exe",
-      "case_id": "L5-008",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [],
-      "description": "导出表异常（需真实工具生成）"
-    },
-    {
-      "filename": "L5-009_shell_in_resource.exe",
-      "case_id": "L5-009",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [],
-      "description": "资源段内嵌字符串（占位）"
-    },
-    {
-      "filename": "L5-015_bad_reloc.exe",
-      "case_id": "L5-015",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "PeParseFailed"
-      ],
-      "description": "重定位表损坏占位"
-    },
-    {
-      "filename": "L5-016_zero_sections.exe",
-      "case_id": "L5-016",
-      "category": "L5",
-      "expected_verdict": "review",
-      "expected_rules": [
-        "PeParseFailed"
-      ],
-      "description": "无节表最小 PE"
-    },
-    {
-      "filename": "L5-019_200mb_huge.exe",
-      "case_id": "L5-019",
-      "category": "L5",
-      "expected_verdict": "unknown",
-      "expected_rules": [],
-      "description": "200MB 超大 PE（占位，真实生成会写满磁盘）"
-    }
-  ],
-  "placeholder_generated_at": "2026-10-29T11:36:17.181303"
+{
+  "meshsafe_target_version": "v0.2.1",
+  "index_regenerated_at": "2026-10-29T11:43:14.552192",
+  "regenerate_note": "expected_rules 已对齐引擎真实输出的 rule 字段（之前是手写瞎编名）",
+  "samples": [
+    {
+      "filename": "L0-001_jpg_normal.jpg",
+      "case_id": "L1-006",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净jpg图片（对照负样本）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-002_png_normal.png",
+      "case_id": "L0-002",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常文件幻数识别-PNG",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-003_docx_normal.docx",
+      "case_id": "L1-007",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净docx文档（对照负样本）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-004_pdf_normal.pdf",
+      "case_id": "L0-004",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "MalformedStructure",
+        "PdfParseFailed"
+      ],
+      "description": "正常文件幻数识别-PDF",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 20.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-005_pe_clean.exe",
+      "case_id": "L1-008",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "干净hello PE（对照负样本）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-006_disguise_jpg_pe.jpg",
+      "case_id": "L0-006",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ExtensionMismatch"
+      ],
+      "description": "jpg 后缀 + 实际 PE MZ 头",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-007_disguise_txt_pdf.txt",
+      "case_id": "L0-007",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ExtensionMismatch",
+        "MalformedStructure"
+      ],
+      "description": "后缀伪装：txt后缀，实际PDF幻数",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-008_disguise_png_zip.png",
+      "case_id": "L0-008",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ExtensionMismatch",
+        "MalformedStructure"
+      ],
+      "description": "后缀伪装：png后缀，实际ZIP幻数",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
+      "case_id": "L0-009",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "DoubleExtension",
+        "PeParseFailed"
+      ],
+      "description": "双扩展名伪装：report.pdf.exe",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
+      "case_id": "L0-010",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "DoubleExtension"
+      ],
+      "description": "双扩展名伪装：data.txt.ps1",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-011_double_ext_docx_js.docx.js",
+      "case_id": "L0-011",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "双扩展名伪装：note.docx.js",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
+      "case_id": "L0-012",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "DoubleExtension"
+      ],
+      "description": "双扩展名伪装：log.xlsx.bat",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-013_clean.ps1",
+      "case_id": "L0-013",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "干净 ps1 文件",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-014_clean.bat",
+      "case_id": "L0-014",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "干净 bat 文件",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-015_clean.cmd",
+      "case_id": "L0-015",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "干净 cmd 文件",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-016_clean.vbs",
+      "case_id": "L0-016",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "干净 vbs 文件",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-017_clean.js",
+      "case_id": "L0-017",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "干净 js 文件",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L0-018_zip_traversal.zip",
+      "case_id": "L0-018",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal",
+        "PathTraversalBlocked"
+      ],
+      "description": "ZIP单级路径穿越：../test.txt",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-019_zip_deep_traversal.zip",
+      "case_id": "L0-019",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "PathTraversal",
+        "PathTraversalBlocked"
+      ],
+      "description": "ZIP多级路径穿越：../../a.txt",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-020_zip_bomb.zip",
+      "case_id": "L0-020",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "ZIP炸弹42.zip",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-021_small_bomb.zip",
+      "case_id": "L0-021",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-022_3layer_nested.zip",
+      "case_id": "L0-022",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "3层无害嵌套ZIP",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-023_5layer_nested.zip",
+      "case_id": "L0-023",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "5 层无害嵌套 ZIP",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-024_encrypted.zip",
+      "case_id": "L0-024",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "加密 ZIP（标记待验证）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-025_corrupt_zip.zip",
+      "case_id": "L0-025",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "ArchiveBroken",
+        "MalformedStructure"
+      ],
+      "description": "截断损坏 ZIP 头",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-026_corrupt_direntry.zip",
+      "case_id": "L0-026",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "损坏ZIP目录项",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-027_long_filename.zip",
+      "case_id": "L0-027",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "压缩包内 200 字符超长文件名",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-028_unicode_filename.zip",
+      "case_id": "L0-028",
+      "category": "L0",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "unicode/emoji 文件名",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L0-029_zero_byte_exe.exe",
+      "case_id": "L0-029",
+      "category": "L0",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "空文件（0字节）后缀exe",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L0-030_nested_traversal.zip",
+      "case_id": "L0-030",
+      "category": "L0",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "嵌套 zip 内含穿越条目",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-001_eicar.txt",
+      "case_id": "L1-001",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "EICAR标准测试串文本",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-002_eicar_in_zip.zip",
+      "case_id": "L1-002",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "EICAR放入zip压缩包",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-003_eicar_in_encrypted.zip",
+      "case_id": "L1-003",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "加密 ZIP（占位：实际加密需 7z/zip -P）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-004_eicar_in_docx.docx",
+      "case_id": "L1-004",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "EICAR放入docx内嵌（OLE）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-005_eicar_modified.txt",
+      "case_id": "L1-005",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "修改 1 字节 EICAR，ClamAV 不应命中",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-009_minimal.cvd",
+      "case_id": "L1-009",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "热加载测试占位（需真实 .cvd 文件）",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-010_corrupt.cvd",
+      "case_id": "L1-010",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "损坏病毒库占位",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-011_eicar_in_3layer.zip",
+      "case_id": "L1-011",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "EICAR放在多层嵌套zip",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-012_eicar_base64.txt",
+      "case_id": "L1-012",
+      "category": "L1",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "base64 编码 EICAR，ClamAV 不解码",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-013_bigfile_eicar.txt",
+      "case_id": "L1-013",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "10MB+ 文本尾部含 EICAR",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_00.txt",
+      "case_id": "L1-014-00",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #0",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_01.txt",
+      "case_id": "L1-014-01",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #1",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_02.txt",
+      "case_id": "L1-014-02",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #2",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_03.txt",
+      "case_id": "L1-014-03",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #3",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_04.txt",
+      "case_id": "L1-014-04",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #4",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_05.txt",
+      "case_id": "L1-014-05",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #5",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_06.txt",
+      "case_id": "L1-014-06",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #6",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_07.txt",
+      "case_id": "L1-014-07",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #7",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_08.txt",
+      "case_id": "L1-014-08",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #8",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_eicar_09.txt",
+      "case_id": "L1-014-09",
+      "category": "L1",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "Eicar-Test-Signature"
+      ],
+      "description": "并发压测占位 #9",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L1-014_concurrent_test.txt",
+      "case_id": "L1-014",
+      "category": "L1",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "并发压测占位（靠 API 并发调用）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L1-015_layer_off_sample.bin",
+      "case_id": "L1-015",
+      "category": "L1",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "Eicar-Test-Signature",
+        "ExtensionMismatch",
+        "PeParseFailed"
+      ],
+      "description": "关闭分层开关测试占位",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L3-001_001_sample.ps1",
+      "case_id": "L3-001",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "RemoteDownloadPowerShell",
+        "SuspiciousScript"
+      ],
+      "description": "PS1明文：Invoke-WebRequest下载",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L3-002_002_sample.ps1",
+      "case_id": "L3-002",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_NC",
+        "DangerousExecutableExtension",
+        "ReverseShellNetcat"
+      ],
+      "description": "PS1明文：反弹shell nc",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L3-003_003_sample.bat",
+      "case_id": "L3-003",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix"
+      ],
+      "description": "bat明文：curl下载payload",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 60.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-004_004_sample.txt",
+      "case_id": "L3-004",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "CredentialStealer"
+      ],
+      "description": "文本包含mimikatz关键字",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 45.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-005_005_sample.txt",
+      "case_id": "L3-005",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "CredentialExport"
+      ],
+      "description": "文本包含reg save导出注册表",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 45.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-006_006_sample.txt",
+      "case_id": "L3-006",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteSessionHijack"
+      ],
+      "description": "文本包含rdp、tscon劫持关键字",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-007_007_sample.txt",
+      "case_id": "L3-007",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "高危串base64编码放在txt",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L3-008_008_sample.ps1",
+      "case_id": "L3-008",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "Powershell字符串拆分拼接绕过",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-009_newline_split.txt",
+      "case_id": "L3-009",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "换行分割绕过（L3 不做换行合并，记录边界）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L3-010_010_sample.ps1",
+      "case_id": "L3-010",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "高危串插入注释分割（powershell #注释）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-011_011_sample.js",
+      "case_id": "L3-011",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix"
+      ],
+      "description": "高危串放js脚本内",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 60.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-012_012_sample.bat",
+      "case_id": "L3-012",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix"
+      ],
+      "description": "正常内网运维curl（白名单对照）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 60.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-013_normal_scp.sh",
+      "case_id": "L3-013",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "内网正常 scp 运维脚本，不误报",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-014_l3001_in_zip.zip",
+      "case_id": "L3-014",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveContainsExecutable",
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在zip内部txt",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-015_keyword_in_docx.docx",
+      "case_id": "L3-015",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在docx文本正文",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-016_016_sample.ps1",
+      "case_id": "L3-016",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "空脚本文件（负样本）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-017_017_sample.txt",
+      "case_id": "L3-017",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "CredentialStealer",
+        "ReverseShellNetcat"
+      ],
+      "description": "多条高危特征同文件复合",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 85.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-018_018_sample.txt",
+      "case_id": "L3-018",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串大小写混写",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-019_unicode_obfuscated.txt",
+      "case_id": "L3-019",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "同形字混淆，L3 默认不命中",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L3-020_log_with_keyword.log",
+      "case_id": "L3-020",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_NC",
+        "ReverseShellNetcat"
+      ],
+      "description": "日志文件混杂正常日志+高危串",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L3-021_021_sample.eml",
+      "case_id": "L3-021",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "高危字符串放在eml邮件正文",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-022_layer_off_sample.bin",
+      "case_id": "L3-022",
+      "category": "L3",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "ExtensionMismatch",
+        "PeParseFailed",
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "关闭分层开关测试占位",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L3-023_keyword_in_encrypted.zip",
+      "case_id": "L3-023",
+      "category": "L3",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "CredentialStealer"
+      ],
+      "description": "加密 zip 内容无法扫描（标记）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 45.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-024_024_sample.txt",
+      "case_id": "L3-024",
+      "category": "L3",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "超长单行文本（10万字符）包含高危串",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L3-025_whitelist_test.txt",
+      "case_id": "L3-025",
+      "category": "L3",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "RemoteDownloadPowerShell"
+      ],
+      "description": "内网白名单域名对照（策略层白名单）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L4-001_001_sample.txt",
+      "case_id": "L4-001",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "YARA正向命中占位（需对应规则）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-002_002_sample.txt",
+      "case_id": "L4-002",
+      "category": "L4",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "干净对照",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-003_pe_with_string.exe",
+      "case_id": "L4-003",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "二进制内嵌匹配字符串",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L4-004_multi_rule_match.txt",
+      "case_id": "L4-004",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "同一个文件同时命中多条 YARA",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-005_005_sample.txt",
+      "case_id": "L4-005",
+      "category": "L4",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "热加载测试占位",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-006_bad_syntax_rule.yar",
+      "case_id": "L4-006",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ExtensionMismatch"
+      ],
+      "description": "语法错误 YARA 规则文件（输入给规则目录）",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "L4-007_meta_rule_match.txt",
+      "case_id": "L4-007",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "带 meta 的 YARA 规则匹配",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-008_in_zip.zip",
+      "case_id": "L4-008",
+      "category": "L4",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "压缩包内文件匹配YARA规则",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-009_yara_in_encrypted.zip",
+      "case_id": "L4-009",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [],
+      "description": "加密 zip 内 YARA 样本",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-010_010_sample.txt",
+      "case_id": "L4-010",
+      "category": "L4",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "正则 YARA 测试占位",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-011_count_condition.txt",
+      "case_id": "L4-011",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "YARA count > 3 条件",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-012_size_condition.bin",
+      "case_id": "L4-012",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "ExtensionMismatch",
+        "PeParseFailed"
+      ],
+      "description": "YARA 文件大小条件",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L4-013_bigfile_yara.txt",
+      "case_id": "L4-013",
+      "category": "L4",
+      "expected_verdict": "reject",
+      "expected_rules": [],
+      "description": "100MB 文件 YARA 扫描",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L4-014_layer_off_sample.bin",
+      "case_id": "L4-014",
+      "category": "L4",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "ExtensionMismatch",
+        "PeParseFailed"
+      ],
+      "description": "关闭分层开关测试占位",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L4-015_hash_whitelist.txt",
+      "case_id": "L4-015",
+      "category": "L4",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "MD5 在白名单",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "L5-001_clean_hello.exe",
+      "case_id": "L5-001",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "原生干净HelloWorld PE（无壳）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-002_upx_shell.exe",
+      "case_id": "L5-002",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "UPX0/UPX1 节名",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-003_double_upx.exe",
+      "case_id": "L5-003",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "UPX加壳PE，二次压缩",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-004_rwx_section.exe",
+      "case_id": "L5-004",
+      "category": "L5",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "节属性 RWX",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-005_injection_imports.exe",
+      "case_id": "L5-005",
+      "category": "L5",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "注入组合导入（需要真实 pefile 引入 API）",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-006_single_virtualalloc.exe",
+      "case_id": "L5-006",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "单一可疑内存 API",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-007_garbage_section.exe",
+      "case_id": "L5-007",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "节名乱码",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-008_many_exports.exe",
+      "case_id": "L5-008",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "导出表异常（需真实工具生成）",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-009_shell_in_resource.exe",
+      "case_id": "L5-009",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "资源段内嵌字符串（占位）",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-010_bad_mz.exe",
+      "case_id": "L5-010",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "ExtensionMismatch",
+        "PeParseFailed"
+      ],
+      "description": "PE 头非法",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "L5-011_truncated.exe",
+      "case_id": "L5-011",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "截断 PE",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-012_pe32.exe",
+      "case_id": "L5-012",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "32 位识别",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-013_pe64.exe",
+      "case_id": "L5-013",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "64 位识别占位",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-014_clean_tool.exe",
+      "case_id": "L5-014",
+      "category": "L5",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "PE导入表大量系统API（正常工具）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-015_bad_reloc.exe",
+      "case_id": "L5-015",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "重定位表损坏占位",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-016_zero_section.exe",
+      "case_id": "L5-016",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "零节 PE 占位",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-016_zero_sections.exe",
+      "case_id": "L5-016",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PEArchInfo",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "无节表最小 PE",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 75.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "L5-017_upx_rwx.exe",
+      "case_id": "L5-017",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "UPX壳 + RWX节复合特征",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-018_debug_info.exe",
+      "case_id": "L5-018",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "调试信息占位",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-019_200mb_huge.exe",
+      "case_id": "L5-019",
+      "category": "L5",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "200MB 超大 PE（占位，真实生成会写满磁盘）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "L5-020_layer_off_sample.bin",
+      "case_id": "L5-020",
+      "category": "L5",
+      "expected_verdict": "review",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "ExtensionMismatch",
+        "PEArchInfo",
+        "RWXSectionDetected",
+        "SuspiciousTimestamp",
+        "UnsignedExecutable"
+      ],
+      "description": "关闭分层开关测试占位",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 6
+    },
+    {
+      "filename": "NEG-001_clean.jpg",
+      "case_id": "NEG-001",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务标准JPG图片",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-002_clean.png",
+      "case_id": "NEG-002",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务PNG图片",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-003_clean.mp4",
+      "case_id": "NEG-003",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务MP4视频",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-004_clean.docx",
+      "case_id": "NEG-004",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务正常docx报表",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-005_clean.xlsx",
+      "case_id": "NEG-005",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务正常xlsx表格",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-006_clean.pdf",
+      "case_id": "NEG-006",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "MalformedStructure",
+        "PdfParseFailed"
+      ],
+      "description": "业务正常PDF报告",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 20.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "NEG-007_clean.java",
+      "case_id": "NEG-007",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "业务源码java文件",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-008_clean.py",
+      "case_id": "NEG-008",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "业务源码python脚本",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "NEG-009_clean.zip",
+      "case_id": "NEG-009",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常业务压缩包zip",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-010_clean.exe",
+      "case_id": "NEG-010",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "正常业务安装包（干净开源）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "NEG-011_clean.log",
+      "case_id": "NEG-011",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常日志文件",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-012_clean.csv",
+      "case_id": "NEG-012",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常csv业务数据文件",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-013_clean.eml",
+      "case_id": "NEG-013",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常eml业务邮件（无附件、无外联恶意）",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-014_clean.dll",
+      "case_id": "NEG-014",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "正常dll（系统干净dll）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "NEG-015_clean.ttf",
+      "case_id": "NEG-015",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常字体文件ttf",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-016_clean.dwg",
+      "case_id": "NEG-016",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常CAD图纸",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "NEG-017_4layer_nested.zip",
+      "case_id": "NEG-017",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "ArchiveBroken",
+        "MalformedStructure"
+      ],
+      "description": "多层嵌套干净zip（无风险）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "NEG-018_clean.bat",
+      "case_id": "NEG-018",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "正常bat运维脚本（内网备份）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "NEG-019_clean.ps1",
+      "case_id": "NEG-019",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "正常ps1运维脚本（内网查询）",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "NEG-020_clean.odt",
+      "case_id": "NEG-020",
+      "category": "NEG",
+      "expected_verdict": "pass",
+      "expected_rules": [],
+      "description": "正常odt文档",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "broken.zip",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "evil.iso",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "evil_help.chm",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "ChmWithScript",
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "linux_malicious",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_Bash",
+        "LinuxExecutable",
+        "ReverseShellNetcat"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "lolbin.cmd",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "CommandExecutionObfuscated",
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 55.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "macro_alert.docm",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "RemoteDownloadPowerShell",
+        "RemoteDownloadUnix",
+        "VBAAutoExecShell"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "malicious.desktop",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_Bash",
+        "C7_Linux_ReverseShell_Misc",
+        "DangerousExecutableExtension",
+        "DesktopFileAutoExec",
+        "ReverseShellNetcat"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 6
+    },
+    {
+      "filename": "malicious.pdf",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "PdfJavaScript",
+        "PdfOpenAction"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "miner_config.json",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "C7_Linux_Miner_Generic"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 45.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "neg_tmp1.zip",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "normal.pdf",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "normal_deploy.sh",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "normal_readme.txt",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "normal_report.docx",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "clean",
+      "expected_rules": [],
+      "description": "",
+      "_last_scan_verdict": "clean",
+      "_last_scan_score": 0.0,
+      "_last_scan_findings": 0
+    },
+    {
+      "filename": "ole_dropper.doc",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "OleToolsUnavailable",
+        "RemoteSessionHijack"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 35.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "pe_downloader.exe",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C1_PE_Downloader_Loader",
+        "DangerousExecutableExtension",
+        "PeParseFailed"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 3
+    },
+    {
+      "filename": "pe_injection.exe",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C1_PE_ProcessInjection",
+        "DangerousExecutableExtension",
+        "PeParseFailed",
+        "RemoteSessionHijack"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "persist_cron.sh",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_Persistence_Crontab",
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix",
+        "ShellScriptDangerous",
+        "Txt.Malware.Sustes-6779550-1"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 6
+    },
+    {
+      "filename": "phishing.eml",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "EmailAttachmentDangerous",
+        "EmailAttachmentDisguised",
+        "EmailAttachmentWebshell",
+        "EmailPhishingKeyword"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 10
+    },
+    {
+      "filename": "photo.jpg.php",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "ransom_dropper.exe.txt",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C8_Ransomware_Encryption",
+        "C8_Ransomware_Note_Filename",
+        "C8_Ransomware_VolumeShadow",
+        "DoubleExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "sealed.docx",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveBroken",
+        "MalformedStructure",
+        "OfficeEncrypted",
+        "OoxmlParseFailed"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "sealed.xlsx",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "ArchiveBroken",
+        "ExtensionMismatch",
+        "MalformedStructure",
+        "OfficeEncrypted",
+        "OoxmlParseFailed"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 5
+    },
+    {
+      "filename": "shell_aspx.aspx",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "shell_bash_devtcp.sh",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_Bash",
+        "DangerousExecutableExtension",
+        "ReverseShellNetcat",
+        "ShellScriptDangerous"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "shell_jsp_runtime.jsp",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_JSP_Webshell_RuntimeExec",
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "shell_nc.sh",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_NC",
+        "DangerousExecutableExtension",
+        "ReverseShellNetcat",
+        "ShellScriptDangerous"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "shell_php_eval.php",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_PHP_Webshell_Oneliner",
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "shell_php_obf.php",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "reject",
+      "expected_rules": [
+        "C3_PHP_Webshell_Obfuscated",
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "reject",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "shell_python.py",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 30.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "shortcut.lnk",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "suspicious",
+      "expected_rules": [
+        "DangerousExecutableExtension",
+        "RemoteDownloadUnix"
+      ],
+      "description": "",
+      "_last_scan_verdict": "suspicious",
+      "_last_scan_score": 60.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "template_backdoor.docx",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "AttachedTemplate"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 1
+    },
+    {
+      "filename": "vba_autoexec.bas",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "RemoteDownloadUnix",
+        "VBAAutoExecShell"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    },
+    {
+      "filename": "wps_macro.js",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "C7_Linux_ReverseShell_Bash",
+        "C7_Linux_ReverseShell_Misc",
+        "DangerousExecutableExtension",
+        "ReverseShellNetcat"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 4
+    },
+    {
+      "filename": "zip_traversal.zip",
+      "case_id": "",
+      "category": "",
+      "expected_verdict": "malicious",
+      "expected_rules": [
+        "PathTraversal",
+        "PathTraversalBlocked"
+      ],
+      "description": "",
+      "_last_scan_verdict": "malicious",
+      "_last_scan_score": 100.0,
+      "_last_scan_findings": 2
+    }
+  ]
 }
\ No newline at end of file