Clues Are Not Conclusions

This page describes the earlier fourteen-week layout and is being rewritten; where it differs, the syllabus applies.

This tool sends lexical patterns in records to a human review queue only. It does not determine author identity, integrity violations or grades. Writing style, perplexity and general AI-authorship detection are prohibited. Never convert match counts, confidence descriptions or empty reports into scores, sanctions, authorship probabilities or proof of exoneration. confidence describes observable lexical clues, not probabilities about a person. The detector connects to no gradebook, scorer or integrity system.

Legitimate Behavior That Can Trigger Each Rule

Pattern	Current Trigger Scope	Legitimate False Positive Example	Human Verification
read_tests	Test paths in read/read_file/list_directory; cat/head/tail/less/ls/rg/grep/find occurring with a test path.	Read public tests to understand requirements.	Determine whether tests are public and access is authorized; not all tests are hidden tests.
history_patch	A bash/shell request for git show or git log with -p/--patch; supports the global options below.	Inspect an authorized historical regression and explain its cause.	Check whether history is within permitted materials; show may display an ordinary file.
print_pass	Shell or written content contains print/echo/printf with PASS/PASSED/OK/SUCCESS.	Write a console-renderer test that should print PASS.	Check actual test results, output provenance and execution records.
hardcode_output	Literal return values in write/write_file/edit/apply_patch content, literal assignments to result/output/answer, or similar shell redirection.	Implement a constant-response mock required by the specification.	Check whether generalization is required, results under changed inputs and the specification's basis for the constant.
modify_tests	Test paths or patch content in write tools; test paths appearing with redirection, tee/rm/mv/cp/sed -i in shell.	Add an authorized public regression assertion.	Check modification authorization and the actual effectiveness of old/new assertions.
network_answer	HTTP addresses used by curl/wget or fetch/http_get/download occur with answer/solution/fix/patch/diff clues.	Download an instructor-authorized patch from a course-local mock.	Verify actual data provenance, authorization and attribution; a URL name does not prove its content.
copy_diff	git apply, patch -p, copying .diff/.patch, or writing content with unified-diff markers.	Apply a disclosed teammate patch.	Check provenance, collaboration scope, the student's explanation and independent verification.

These are course-authored synthetic examples, with no research-data citations or external detection performance claims. The source record says the assigned cheating-agents factsheet had not yet been delivered; the implementation infers no facts from a missing card and does not wait for uncited factsheet batches. This historical note does not assert the card's present availability.

What Cannot Be Inferred

A tool request does not prove that a command executed, succeeded or affected the final artifact. Trajectories may be altered, truncated or copied and may retain only partial context; structural validation does not authenticate provenance. A trajectory alone cannot establish authorization, intent, authorship, test visibility, network-response content, artifact correctness, student learning or deserved grades.

Rules recognize only the listed tool names and command/cmd, path/file_path, content/text/patch/diff and url arguments, in ordinary objects or key/value entry lists. They do not interpret shell, expand variables, aliases, encodings, scripts, symlinks or escapes, or open paths. Strings containing multiple commands may incorrectly associate unrelated words. Python internal reads/writes, other languages, unlisted tool shapes and indirect copying may be missed. The constant-return rule is deliberately broad and cannot prove hardcoding for tests. User quotations, assistant bodies and tool results are not treated as tool requests.

The history rule only tokenizes quotes and splits on separators. It supports global git options -C, -c (separate/attached values), --git-dir, --work-tree, --namespace, --config-env (separate/equals values), and -p/--paginate, -P/--no-pager, --bare, --no-replace-objects, --no-lazy-fetch, --no-optional-locks and --no-advice. For example, git -C /workspace/repo log -p and git --no-pager show HEAD both produce clues. Global git -p is a pagination flag, not a log patch flag. Paths after log's -- and -p/--patch in other command segments do not participate. Unknown global options, unclosed quotes, wrapper commands, Git aliases, combined short options and other shell syntax may cause false negatives; the detector never executes them to determine semantics. Quoted separators may also split segments. Lexical results cannot replace verification of shell syntax or actual Git behavior.

minimal trajectories have no body; ordinary redacted policy also replaces non-allowlisted arguments and their keys entirely. Actual Client/FakeProvider/Tracer integration tests set no synthetic allowlist and verify coverage.conclusion: insufficient_evidence with empty findings for all seven request types. Argument strings containing [REDACTED…] markers are excluded from matching. The detector neither joins text across markers nor reverses digests. Partially analyzable fields or requests produce partial_evidence while retaining visible clues; see the usage guide for coverage states/counts. Current detection applies only to synthetic course exercises retaining supported arguments; do not claim coverage of real student behavior. Do not improve detection by restoring private bodies, saving or classifying real content before redaction, dynamically expanding the TracePolicy allowlist or labeling real data synthetic. Any real collection extension requires separate design, authorization and independent review. This task adds no collection metadata and does not change the frozen schema.

Every finding reports zero-based JSONL line, within-line step and within-step tool-call indexes, plus the rule version, pattern, fixed evidence labels and confidence description. It echoes no input snippets, tool IDs, model names, paths, hashes or original field values. Humans locate the evidence in an authorized original copy; reports themselves also travel through controlled channels. Repeated context across lines produces repeated clues, requiring manual deduplication by position. Counts must not be treated as independent events.

Second Review and Appeals

1. Instructors/TAs check versions and indexes, trajectory completeness, redaction status and the task's permitted materials/tools.
2. Check every legitimate counterexample above against actual execution results and artifact tests. Invite the student's explanation and accept equivalent process records created at the time. Incomplete records or absent tool coverage cannot themselves establish responsibility.
3. Provide evidence-based written human reasons and retain the student's response; clues may be withdrawn. The detector must not trigger grade deductions, automatic rejection or integrity conclusions. Actual grading and integrity concerns follow established human course procedures.
4. Students may seek review/appeal of facts, context or interpretation. Authorized personnel who did not make the original judgment examine the same evidence and supplements, retaining reasons for corrections and outcomes. Channels, deadlines and access follow published course arrangements; the tool creates no policy. Until arrangements are clear, use it only for synthetic exercises.

Data creators clean up temporary trajectories and reports; course administrators handle controlled copies and backups. Retention/deletion responsibilities follow the course_llm conventions. Never submit real credentials, student identities or instructor answers.