rule Lobera_RenEngine_Planner_Source_Pattern
{
    meta:
        description = "Experimental hunting pattern for extracted Python source containing the documented planner call path"
        author = "Lobera"
        date = "2026-09-09"
        status = "experimental"
        scope = "One extracted Python text file; does not unpack archives or identify a PE launcher"
        validation = "Compile and controlled text fixtures only; original scripts and benign corpus still required"

    strings:
        $entry = "def is_sandboxed(" ascii
        $specs = "def _check_specs(" ascii
        $return_path = /return[ \t]+self\._normalize\([ \t]*\[s5,[ \t]*s6\][ \t]*\)/ ascii

    condition:
        filesize < 128KB and all of them
}