fix(ttp): expand R0054/R0055/R0057 emits + LAST_REVIEWED markers

The IntelLifter's _emit_filtered fans out only the rule.emits entries
whose technique_id appears in the predicate's decision set. v1's emits
lists were narrow supersets of the common case, silently dropping the
rest of the predicate's possible emissions:

  R0054 dropped: T1046 (cat 14), T1078 (cat 20), T1090 (cats 9/13),
                 T1496 (cat 11), T1595 (cats 14/19)
  R0055 dropped: T1090 (tor_exit_node), T1110 (ssh_bruteforcer),
                 T1588 (the second emit of every C2-framework tag)
  R0057 dropped: T1105 (payload_delivery, download_url)

Bump rule_version 1->2 on R0054/R0055/R0057, expand emits to cover
every technique the predicate produces. R0056 (Feodo) and R0058
(aggregate bump) carry no enum and stay at v1.

All five YAMLs gain `last_reviewed: "2026-05-02"` and
`next_review: "2026-08-02"` markers; the rule YAML is now the
canonical record of when the mapping was last reconciled against
upstream, with DEBT.md as the calendar reminder.

rules/ttp/R0054.yaml

@@ -1,10 +1,19 @@
 rule_id: R0054
-rule_version: 1
+rule_version: 2
+last_reviewed: "2026-05-02"
+next_review: "2026-08-02"
 name: abuseipdb_category
 description: |
   AbuseIPDB category → ATT&CK technique mapping per Appendix A.10.
-  IntelLifter reads AttackerIntel.abuseipdb_categories and emits
+  IntelLifter reads AttackerIntel.abuseipdb_categories and emits one
-  one tag per matching category code.
+  tag per technique the predicate selects from the matched categories.
+
+  v2 (2026-05-02 ship-time audit): expanded ``emits`` to cover every
+  technique the predicate can produce — v1 silently dropped T1046
+  (cat 14), T1078 (cat 20), T1090 (cats 9/13), T1496 (cat 11),
+  T1498 (cat 4 — still unmapped intentionally), T1595 (cats 14/19).
+  Also corrects the cat 10/17 → 4/13 wire-vs-design typo and adds
+  cat 7 (Phishing) → T1566 and cat 16 (SQL Injection) → T1190.
 applies_to:
   - intel
 match:
@@ -20,6 +29,21 @@ emits:
   - tactic: TA0001
     technique_id: T1566
     confidence: 0.7
+  - tactic: TA0007
+    technique_id: T1046
+    confidence: 0.7
+  - tactic: TA0001
+    technique_id: T1078
+    confidence: 0.6
+  - tactic: TA0011
+    technique_id: T1090
+    confidence: 0.6
+  - tactic: TA0040
+    technique_id: T1496
+    confidence: 0.6
+  - tactic: TA0043
+    technique_id: T1595
+    confidence: 0.7
 evidence_fields:
   - abuseipdb_categories
-  - abuse_confidence_score
+  - abuseipdb_score

rules/ttp/R0055.yaml

@@ -1,10 +1,20 @@
 rule_id: R0055
-rule_version: 1
+rule_version: 2
+last_reviewed: "2026-05-02"
+next_review: "2026-08-02"
 name: greynoise_classification
 description: |
   GreyNoise classification + tag → ATT&CK technique per A.10.
   IntelLifter reads AttackerIntel.greynoise_classification and
-  greynoise_tags.
+  greynoise_tags. Note: the Community endpoint does not return tags;
+  the tag-driven emits become live only when an operator wires a
+  non-Community provider plan that does.
+
+  v2 (2026-05-02 ship-time audit): expanded ``emits`` to cover
+  T1090 (tor_exit_node), T1110 (ssh_bruteforcer), T1588 (C2-framework
+  tags' second emit) — v1 silently dropped all three. Bare
+  ``classification == "malicious"`` now lights T1071 at half
+  multiplier when no recognised tag fires.
 applies_to:
   - intel
 match:
@@ -18,6 +28,16 @@ emits:
   - tactic: TA0011
     technique_id: T1071
     confidence: 0.7
+  - tactic: TA0011
+    technique_id: T1090
+    confidence: 0.7
+  - tactic: TA0006
+    technique_id: T1110
+    confidence: 0.7
+  - tactic: TA0042
+    technique_id: T1588
+    confidence: 0.7
 evidence_fields:
   - greynoise_classification
   - greynoise_tags
+  - greynoise_name

rules/ttp/R0056.yaml

@@ -1,9 +1,16 @@
 rule_id: R0056
 rule_version: 1
+last_reviewed: "2026-05-02"
+next_review: "2026-08-02"
 name: feodo_tracker_hit
 description: |
   Source IP listed by abuse.ch Feodo Tracker — known C2 infra,
   family attribution attached.
+
+  No drift in 2026-05-02 ship-time audit: Feodo's data shape is
+  feed-driven (one entry per listed IP), no enum to bump. Family
+  flows through evidence as a string and does not need a code-level
+  taxonomy. Reviewed and unchanged.
 applies_to:
   - intel
 match:
@@ -19,5 +26,6 @@ emits:
     sub_technique_id: T1588.001
     confidence: 0.85
 evidence_fields:
-  - malware_family
+  - feodo_listed
+  - feodo_malware_family
   - first_seen_feodo

rules/ttp/R0057.yaml

@@ -1,9 +1,20 @@
 rule_id: R0057
-rule_version: 1
+rule_version: 2
-name: threatfox_ioc
+last_reviewed: "2026-05-02"
+next_review: "2026-08-02"
+name: threatfox_threat_type
 description: |
-  abuse.ch ThreatFox IOC type → ATT&CK technique mapping with
+  abuse.ch ThreatFox ``threat_type`` → ATT&CK technique mapping with
   family attribution.
+
+  v2 (2026-05-02 ship-time audit): keys on ``threat_type`` (the
+  canonical ThreatFox taxonomy) instead of ``ioc_type`` — v1 had it
+  backwards, ``ioc_type`` is the indicator format (url / domain /
+  hash) and carries no ATT&CK signal. Also expanded ``emits`` to
+  include T1105 (payload_delivery) and T1056 (cc_skimming) which v1
+  silently dropped, and the lifter now reads from the bus payload
+  fields ``threatfox_threat_types`` (list) populated by the intel
+  worker.
 applies_to:
   - intel
 match:
@@ -17,7 +28,13 @@ emits:
     technique_id: T1588
     sub_technique_id: T1588.001
     confidence: 0.8
+  - tactic: TA0011
+    technique_id: T1105
+    confidence: 0.75
+  - tactic: TA0009
+    technique_id: T1056
+    confidence: 0.7
 evidence_fields:
-  - ioc_type
+  - threatfox_threat_types
-  - malware_family
+  - threatfox_ioc_types
-  - threat_type
+  - threatfox_malware_families

rules/ttp/R0058.yaml

@@ -1,5 +1,7 @@
 rule_id: R0058
 rule_version: 1
+last_reviewed: "2026-05-02"
+next_review: "2026-08-02"
 name: aggregate_malicious_verdict_bump
 description: |
   Aggregate intel verdict = "malicious" with no specific provider