Pattern grammars#

Patterns are portable only when their field's grammar is respected. A tool allowlist does not accept a glob just because a path rule does.

Pattern class	Fields	Matching
Path glob	Forbidden paths, path allowlists, secret skip paths	Normalized path segments
Host pattern	Egress and browser host lists, origin egress	Normalized DNS host or exact IP
Regex	Secret patterns, shell patterns, patch patterns, extra credential patterns	Restricted portable regex
Exact string	Tool names, input types, browser verbs, language IDs	No wildcard expansion

The normative algorithms are core section 3.14; the wire and identifier grammars are in Grammars.

Paths#

Normalize NFC, convert backslashes to slashes, collapse dot segments, and strip a trailing slash before matching. * and ? do not cross a slash; ** can cross path segments. Brackets and braces are literal, not shell expansions. Matching is case-sensitive regardless of the host filesystem. This is lexical normalization, not filesystem resolution: the host must handle symlinks and TOCTOU when opening the actual file.

An exception in forbidden_paths exempts only that block. It does not exempt the action from a path allowlist or content scan.

Hosts#

Extract the host, strip scheme/userinfo/port/path/query, lowercase, remove a trailing dot, and apply IDNA conversion. *.example.com matches one label; **.example.com matches one or more. Neither implies the apex example.com. IP literals require exact matches. Block entries take precedence over allows.

A matching hostname is an authorization decision, not a DNS or network sandbox. For fetching policies, use the separately bounded HTTPS loaders and their resolved-address protections.

Regular expressions#

The portable profile disallows lookaround, backreferences and POSIX classes. It permits named groups but uses ASCII \d, \w, \s, \b and ASCII-only case-insensitive folding. The maximum pattern length is 2048 bytes. Use single-quoted YAML for literal regex backslashes, or double the backslash inside a double-quoted YAML string.

yaml

hushspec: "1.0.0"
name: token-output-gate
rules:
  secret_patterns:
    patterns:
      - name: synthetic-token
        pattern: 'TEST_TOKEN_[A-Z0-9]{16}'
        severity: error

Validate the actual YAML bytes with h2h validate --strict policy.yaml. A regex that compiles in one language's native engine can still be outside the portable profile. See error codes for E005.