Corpus 294 to 296 rules with two source-honest canonical templates (T1498 Network Denial of Service, T1056.001 Keylogging), each with matching and non-matching sidecar evidence.
- Sidecars completed for every status:test rule; CI now requires a .sample.json for each.
- Zero-debt linter gate: broad empty matches, unsafe regex, underspecified logsource, scaffolding, deprecated pipe conditions and placeholder false positives are now blocking.
- Cursor and any-MCP-client setup documented next to the Claude Code and Codex plugins.
- README rewritten for a tighter, professional structure.
See CHANGELOG.md for full detail.