From 07ca5d4084037ea9bd713cf505b24ccc534ea5b3 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 09:57:00 -0400
Subject: [PATCH 01/14] Expose matched rule description after policy evaluation

---
 c/src/eval_ctx.c  |  9 +++++++++
 c/src/eval_ctx.h  | 18 ++++++++++++++++++
 c/src/evaluator.c | 28 +++++++++++++++++++++++++++-
 3 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index a49b6c9..f8b71c8 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -208,6 +208,14 @@ plcs_errors plcs_eval_ctx_get_unum_eval_error(plcs_numeric_evaluators ix) {
   return PLCS_EIX_OVERFLOW;
 }
 
+const char *plcs_eval_ctx_get_matched_description(void) {
+  return ctx.matched_description;
+}
+
+void plcs_eval_ctx_set_matched_description(const char *description) {
+  ctx.matched_description = description;
+}
+
 plcs_errors plcs_eval_ctx_peek_last_error(void) {
   return ctx.error;
 }
@@ -244,6 +252,7 @@ void plcs_eval_ctx_reset(void) {
   }
 
   ctx.error = PLCS_ESUCCESS;
+  ctx.matched_description = NULL;
 }
 
 plcs_errors plcs_eval_ctx_init(void) {
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index f4ff4a5..97264dc 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -111,6 +111,12 @@ typedef struct plcs_eval_ctx {
   /**< TODO: consider implementing this as a stack to preserve history of errors */
   plcs_errors error;
 
+  /**< Description of the rule that triggered the action during the most recent
+   * policy evaluation. NULL if no match occurred. Read via
+   * plcs_eval_ctx_get_matched_description().
+   */
+  const char *matched_description;
+
 } plcs_eval_ctx;
 
 /**
@@ -146,3 +152,15 @@ void plcs_eval_ctx_set_num_eval_error(plcs_numeric_evaluators id, plcs_errors er
  * @param error plcs_errors enum
  */
 void plcs_eval_ctx_set_unum_eval_error(plcs_numeric_evaluators ix, plcs_errors error);
+
+/**
+ * @brief Returns the description of the rule that triggered the action during the most recent policy evaluation.
+ * @return const char* NULL if no match occurred.
+ */
+const char *plcs_eval_ctx_get_matched_description(void);
+
+/**
+ * @brief Sets the description of the rule that triggered the action during the most recent policy evaluation.
+ * @param description const char* description of the rule that triggered the action.
+ */
+void plcs_eval_ctx_set_matched_description(const char *description);
\ No newline at end of file
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index a2875ed..92855d7 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -168,6 +168,24 @@ plcs_evaluation_result DoOper(dd_ns(BoolOperation_enum_t) oper, plcs_evaluation_
   }
 }
 
+static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) node) {
+  if (!node) {
+    return;
+  }
+  const char *description = NULL;
+  switch (dd_ns(NodeTypeWrapper_node_type)(node)) {
+    case dd_ns(NodeType_CompositeNode):
+      description = dd_ns(CompositeNode_description)(dd_ns(NodeTypeWrapper_node)(node));
+      break;
+    case dd_ns(NodeType_EvaluatorNode):
+      description = dd_ns(EvaluatorNode_description)(dd_ns(NodeTypeWrapper_node)(node));
+      break;
+  }
+  if (description && description[0] != '\0') {
+    plcs_eval_ctx_set_matched_description(description);
+  }
+}
+
 plcs_evaluation_result composite_evaluator(dd_ns(CompositeNode_table_t) node, int depth) {
   if (!node) {
     return PLCS_EVAL_RESULT_ABSTAIN;
@@ -209,6 +227,7 @@ plcs_evaluation_result composite_evaluator(dd_ns(CompositeNode_table_t) node, in
 
     // short circuit
     if (oper == dd_ns(BoolOperation_BOOL_OR) && res == PLCS_EVAL_RESULT_TRUE) {
+      capture_matched_description(dd_ns(NodeTypeWrapper_vec_at)(children, ix));
       return res;
     }
 
@@ -286,9 +305,16 @@ plcs_errors evaluate_policy(dd_ns(Policy_table_t) policy) {
   // extract rules
   dd_ns(NodeTypeWrapper_table_t) rules = dd_ns(Policy_rules)(policy);
 
-  // // evaluate rules if they exist, otherwise return EVAL_RESULT_ABSTAIN
+  // reset matched description
+  plcs_eval_ctx_set_matched_description(NULL);
+
+  // evaluate rules if they exist, otherwise return EVAL_RESULT_ABSTAIN
   plcs_evaluation_result eval_res = rules ? evaluate_rules(rules, 0) : PLCS_EVAL_RESULT_ABSTAIN;
 
+  if (eval_res == PLCS_EVAL_RESULT_TRUE && (plcs_eval_ctx_get_matched_description() == NULL || plcs_eval_ctx_get_matched_description()[0] == '\0')) {
+    capture_matched_description(rules);
+  }
+  
   // perform actions given evaluation result
   return perform_actions(eval_res, actions);
 }

From d3e9e82e9fdfcfcabff3f6674d73e444069b323f Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 10:16:39 -0400
Subject: [PATCH 02/14] formatting

---
 c/src/evaluator.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index 92855d7..655280f 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -311,10 +311,11 @@ plcs_errors evaluate_policy(dd_ns(Policy_table_t) policy) {
   // evaluate rules if they exist, otherwise return EVAL_RESULT_ABSTAIN
   plcs_evaluation_result eval_res = rules ? evaluate_rules(rules, 0) : PLCS_EVAL_RESULT_ABSTAIN;
 
-  if (eval_res == PLCS_EVAL_RESULT_TRUE && (plcs_eval_ctx_get_matched_description() == NULL || plcs_eval_ctx_get_matched_description()[0] == '\0')) {
+  if (eval_res == PLCS_EVAL_RESULT_TRUE &&
+      (plcs_eval_ctx_get_matched_description() == NULL || plcs_eval_ctx_get_matched_description()[0] == '\0')) {
     capture_matched_description(rules);
   }
-  
+
   // perform actions given evaluation result
   return perform_actions(eval_res, actions);
 }

From 34c7ee0ec0e1df1cc506b20dd040b74a20f13841 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 15:43:13 -0400
Subject: [PATCH 03/14] add a setter function for getitng description with eval
 details

---
 c/src/eval_ctx.c                              |   9 ++
 c/src/eval_ctx.h                              |  15 +-
 c/src/evaluator.c                             |   7 +-
 c/src/test/test_evaluator.c                   | 143 ++++++++++++++++++
 .../test/test_matched_description_policies.h  | 124 +++++++++++++++
 5 files changed, 296 insertions(+), 2 deletions(-)
 create mode 100644 c/src/test/test_matched_description_policies.h

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index f8b71c8..dd4049c 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -15,6 +15,7 @@
 
 static plcs_eval_ctx ctx;
 static bool plcs_eval_ctx_initialized = false;
+static char description_with_evaluation_details[1024];
 
 plcs_errors
 plcs_eval_ctx_register_str_evaluator(plcs_string_evaluator_function_ptr func_ptr, plcs_string_evaluators ix) {
@@ -216,6 +217,14 @@ void plcs_eval_ctx_set_matched_description(const char *description) {
   ctx.matched_description = description;
 }
 
+void plcs_eval_ctx_set_matched_description_with_evaluation_details(const char *rule_description, const char* evaluator_description) {
+  if (!rule_description || !evaluator_description) {
+    return;
+  }
+  snprintf(description_with_evaluation_details, sizeof(description_with_evaluation_details), "%s: %s", rule_description, evaluator_description);
+  ctx.matched_description = description_with_evaluation_details;
+}
+
 plcs_errors plcs_eval_ctx_peek_last_error(void) {
   return ctx.error;
 }
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index 97264dc..fba445d 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -117,6 +117,12 @@ typedef struct plcs_eval_ctx {
    */
   const char *matched_description;
 
+  /**< Description of the rule that triggered the action during the most recent
+   * policy evaluation for hardcoded rules. NULL if no match occurred. Read via
+   * plcs_eval_ctx_get_matched_description_hardcoded_rules().
+   */
+  const char *matched_description_hardcoded_rules;
+
 } plcs_eval_ctx;
 
 /**
@@ -163,4 +169,11 @@ const char *plcs_eval_ctx_get_matched_description(void);
  * @brief Sets the description of the rule that triggered the action during the most recent policy evaluation.
  * @param description const char* description of the rule that triggered the action.
  */
-void plcs_eval_ctx_set_matched_description(const char *description);
\ No newline at end of file
+void plcs_eval_ctx_set_matched_description(const char *description);
+
+/**
+ * @brief Sets matched_description to "{rule_description}: {evaluator_description}".
+ * @param rule_description description of the matched composite rule.
+ * @param evaluator_description description of the specific evaluator condition that triggered the match.
+ */
+void plcs_eval_ctx_set_matched_description_with_evaluation_details(const char *rule_description, const char *evaluator_description);
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index 655280f..5cc47bf 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -182,7 +182,12 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
       break;
   }
   if (description && description[0] != '\0') {
-    plcs_eval_ctx_set_matched_description(description);
+    const char *existing = plcs_eval_ctx_get_matched_description();
+    if (dd_ns(NodeTypeWrapper_node_type)(node) == dd_ns(NodeType_CompositeNode) && existing && existing[0] != '\0') {
+      plcs_eval_ctx_set_matched_description_with_evaluation_details(description, existing);
+    } else {
+      plcs_eval_ctx_set_matched_description(description);
+    }
   }
 }
 
diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index c4c3a1c..f7f3fdb 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -58,6 +58,7 @@
 
 /* Test-specific headers */
 #include "hardcoded_policies.h"
+#include "test_matched_description_policies.h"
 
 // unexported functions
 extern plcs_evaluation_result string_evaluator_exact(const char *eval, const char *param);
@@ -1003,3 +1004,145 @@ UTEST(evaluator_integration, evaluate_generated_header_if_available) {
   ASSERT_TRUE(1);
 #endif
 }
+
+/*
+ * End-to-end matched_description tests using a generated FlatBuffers header.
+ *
+ * Policies are defined in test_matched_description.json and compiled to
+ * test_matched_description_policies.h. Three policies exercise the three
+ * distinct capture paths:
+ *   [0] Nested OR combination  (runtime=jvm, 2 conditions)
+ *   [1] Flat OR, no runtime    (runtime=all, 1 condition, 2 values)
+ *   [2] AND fallback           (runtime=jvm, 1 condition, 1 value)
+ *
+ * matched_description is reset at the start of each evaluate_policy() call,
+ * so it must be read inside the action callback, which only saves it when
+ * the evaluation result is PLCS_EVAL_RESULT_TRUE.
+ */
+static const char *g_captured_description = NULL;
+
+static plcs_errors test_action_capture(
+    plcs_evaluation_result res,
+    char *values[],
+    size_t value_len,
+    const char *description,
+    int action_id
+) {
+  (void)values;
+  (void)value_len;
+  (void)description;
+  (void)action_id;
+  if (res == PLCS_EVAL_RESULT_TRUE) {
+    g_captured_description = plcs_eval_ctx_get_matched_description();
+  }
+  return PLCS_ESUCCESS;
+}
+
+static void matched_description_test_setup(void) {
+  plcs_eval_ctx_init();
+  plcs_eval_ctx_reset();
+  g_captured_description = NULL;
+  plcs_eval_ctx_register_action(test_action_capture, PLCS_ACTION_INJECT_DENY);
+  plcs_eval_ctx_register_action(test_action_capture, PLCS_ACTION_INJECT_ALLOW);
+  plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_RUNTIME_LANGUAGE);
+  plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_FILE);
+  plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS);
+  plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_PROCESS_EXE);
+  plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_PROCESS_EXE_FULL_PATH);
+}
+
+/*
+ * Policy [0]: "Nested OR combination" (runtime=jvm)
+ * Tree: AND[Nested OR combination]
+ *         EvaluatorNode[Runtime matching]
+ *         OR[Nested OR combination]
+ *           OR[Cassandra group]        <- condition with 2 values
+ *             EvaluatorNode[matched CassandraDaemon]
+ *             EvaluatorNode[matched Cassandra tools]
+ *           EvaluatorNode[matched kafka]  <- condition with 1 value
+ *
+ * When CassandraDaemon matches: OR[Cassandra group] captures "matched CassandraDaemon",
+ * then outer OR combines it: "Cassandra group: matched CassandraDaemon".
+ */
+UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description != NULL);
+  ASSERT_EQ(strcmp(g_captured_description, "Cassandra group: matched CassandraDaemon"), 0);
+}
+
+/* Same policy, single-value condition: outer OR short-circuits on EvaluatorNode directly,
+ * no combination — just the leaf description. */
+UTEST(evaluator_matched_description, nested_or_leaf_no_combination) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_PROCESS_EXE, "kafka");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description != NULL);
+  ASSERT_EQ(strcmp(g_captured_description, "matched kafka"), 0);
+}
+
+/*
+ * Policy [1]: "Flat OR no runtime" (runtime=all)
+ * Tree: OR[Skip processes launched from OS system binary directories]
+ *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/']
+ *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting with '/sbin/']
+ *
+ * No AND wrapper, no outer OR — EvaluatorNode description captured directly.
+ */
+UTEST(evaluator_matched_description, flat_or_leaf_captured_directly) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_FILE, "/bin/bash");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description != NULL);
+  ASSERT_EQ(strcmp(g_captured_description, "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"), 0);
+}
+
+UTEST(evaluator_matched_description, flat_or_second_leaf) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_FILE, "/usr/bin/python");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description != NULL);
+  ASSERT_EQ(strcmp(g_captured_description, "Skip process launched from a system binary directory: matched on entry point file path starting with '/usr/bin/'"), 0);
+}
+
+/*
+ * Policy [2]: "AND fallback" (runtime=jvm, single condition with 1 value)
+ * Tree: AND[AND fallback]
+ *         EvaluatorNode[Runtime matching]
+ *         EvaluatorNode[matched org.example.App]
+ *
+ * AND never calls capture_matched_description in its loop. The post-evaluation
+ * fallback in evaluate_policy fires and captures the root AND node's description.
+ */
+UTEST(evaluator_matched_description, and_fallback_captures_root_description) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.example.App");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description != NULL);
+  ASSERT_EQ(strcmp(g_captured_description, "AND fallback"), 0);
+}
+
+/* No policy matches: g_captured_description is never set to a non-NULL value. */
+UTEST(evaluator_matched_description, no_match_description_is_null) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "com.mycompany.MyApp");
+
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+
+  ASSERT_TRUE(g_captured_description == NULL);
+}
diff --git a/c/src/test/test_matched_description_policies.h b/c/src/test/test_matched_description_policies.h
new file mode 100644
index 0000000..3eb9782
--- /dev/null
+++ b/c/src/test/test_matched_description_policies.h
@@ -0,0 +1,124 @@
+#pragma once
+#include <stdint.h>
+
+static const uint8_t test_matched_description_policies[] = {
+  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00,
+  0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
+  0x98, 0x02, 0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+  0x7e, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00,
+  0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+  0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c,
+  0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x6e, 0xfd, 0xff, 0xff,
+  0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+  0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
+  0x6a, 0x76, 0x6d, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20,
+  0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00,
+  0x98, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
+  0x42, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00,
+  0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20,
+  0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00,
+  0xd4, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
+  0xca, 0xfb, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
+  0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67,
+  0x00, 0x00, 0x00, 0x00, 0xba, 0xfb, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
+  0x1c, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
+  0x12, 0xfc, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63,
+  0x68, 0x65, 0x64, 0x20, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d,
+  0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0x06, 0xfc, 0xff, 0xff,
+  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x0f, 0x00, 0x00, 0x00,
+  0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e,
+  0x41, 0x70, 0x70, 0x00, 0xba, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+  0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+  0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x46, 0x6c, 0x61, 0x74,
+  0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69,
+  0x6d, 0x65, 0x00, 0x00, 0xae, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
+  0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00,
+  0x12, 0x00, 0x00, 0x00, 0x46, 0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20,
+  0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00, 0x00,
+  0xdc, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
+  0x86, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
+  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00,
+  0x1c, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74,
+  0x65, 0x6d, 0x20, 0x70, 0x61, 0x74, 0x68, 0x20, 0x67, 0x72, 0x6f, 0x75,
+  0x70, 0x00, 0x00, 0x00, 0x1c, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
+  0x04, 0x00, 0x00, 0x00, 0x12, 0xfd, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00,
+  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x15, 0x00, 0x00, 0x00,
+  0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
+  0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00,
+  0x06, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01,
+  0x09, 0x00, 0x00, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e,
+  0x2f, 0x00, 0x00, 0x00, 0x70, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
+  0x04, 0x00, 0x00, 0x00, 0x66, 0xfd, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
+  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x00, 0x00,
+  0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
+  0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x56, 0xfd, 0xff, 0xff,
+  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x05, 0x00, 0x00, 0x00,
+  0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00,
+  0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+  0x70, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+  0x28, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74,
+  0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e,
+  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0f, 0x00,
+  0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
+  0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
+  0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f,
+  0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+  0x6e, 0x00, 0x00, 0x00, 0x3c, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02,
+  0x04, 0x00, 0x00, 0x00, 0xe6, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
+  0x24, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00,
+  0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f,
+  0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00,
+  0x80, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
+  0x76, 0xfe, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
+  0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67,
+  0x00, 0x00, 0x00, 0x00, 0x66, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
+  0xc8, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
+  0x72, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
+  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00,
+  0x20, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74,
+  0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e,
+  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0c, 0xff, 0xff, 0xff,
+  0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x02, 0xff, 0xff, 0xff,
+  0x20, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+  0x0d, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
+  0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0xee, 0xfe, 0xff, 0xff,
+  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00,
+  0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x54, 0xff, 0xff, 0xff,
+  0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
+  0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00,
+  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
+  0x02, 0x00, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+  0x0f, 0x00, 0x00, 0x00, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72,
+  0x61, 0x20, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x00, 0x9c, 0xff, 0xff, 0xff,
+  0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x92, 0xff, 0xff, 0xff,
+  0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+  0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
+  0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x74, 0x6f,
+  0x6f, 0x6c, 0x73, 0x00, 0x86, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
+  0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
+  0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00,
+  0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
+  0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00,
+  0x34, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+  0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
+  0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65,
+  0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x0c, 0x00, 0x0a, 0x00,
+  0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+  0x00, 0x00, 0x0a, 0x04, 0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
+  0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
+  0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+  0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61,
+  0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
+};
+static const unsigned int test_matched_description_policies_len = 1412;

From f022d2ad9989f62b3af8e12de3913127f39ffbea Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 15:48:16 -0400
Subject: [PATCH 04/14] add example hardcoded json file for testing

---
 .../test_matched_description.json             | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json

diff --git a/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json b/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json
new file mode 100644
index 0000000..593dda2
--- /dev/null
+++ b/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json
@@ -0,0 +1,81 @@
+{
+  "policies": [
+    {
+      "description": "Nested OR combination",
+      "skip": true,
+      "runtime": "jvm",
+      "conditions": [
+        {
+          "description": "Cassandra group",
+          "values": [
+            {
+              "cmp_strategy": "equals",
+              "value": "org.apache.cassandra.service.CassandraDaemon",
+              "value_type": "class",
+              "description": "matched CassandraDaemon"
+            },
+            {
+              "cmp_strategy": "prefix",
+              "value": "org.apache.cassandra.tools",
+              "value_type": "class",
+              "description": "matched Cassandra tools"
+            }
+          ]
+        },
+        {
+          "description": "Kafka group",
+          "values": [
+            {
+              "cmp_strategy": "equals",
+              "value": "kafka",
+              "value_type": "process_exe",
+              "description": "matched kafka"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "description": "Flat OR no runtime",
+      "skip": true,
+      "runtime": "all",
+      "conditions": [
+        {
+          "description": "Skip processes launched from OS system binary directories",
+          "values": [
+            {
+              "cmp_strategy": "prefix",
+              "value": "/bin/",
+              "value_type": "entry_file",
+              "description": "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"
+            },
+            {
+              "cmp_strategy": "prefix",
+              "value": "/usr/bin/",
+              "value_type": "entry_file",
+              "description": "Skip process launched from a system binary directory: matched on entry point file path starting with '/usr/bin/'"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "description": "AND fallback",
+      "skip": true,
+      "runtime": "jvm",
+      "conditions": [
+        {
+          "description": "Single condition",
+          "values": [
+            {
+              "cmp_strategy": "equals",
+              "value": "org.example.App",
+              "value_type": "class",
+              "description": "matched org.example.App"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

From 77d4f494b79f9fd4c6880ea64040897a83955458 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 15:54:27 -0400
Subject: [PATCH 05/14] add plcs_eval_ctx_get_matched_description to public
 header

---
 c/include/dd/policies/eval_ctx.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/c/include/dd/policies/eval_ctx.h b/c/include/dd/policies/eval_ctx.h
index e4316ab..76e4d4e 100644
--- a/c/include/dd/policies/eval_ctx.h
+++ b/c/include/dd/policies/eval_ctx.h
@@ -219,3 +219,11 @@ plcs_errors plcs_eval_ctx_get_unum_eval_error(plcs_numeric_evaluators ix);
     plcs_eval_ctx_register_str_evaluator(function_ptr, id);                                                            \
     plcs_eval_ctx_set_str_eval_param(id, param);                                                                       \
   } while (0)
+
+/**
+ * @brief Returns the description of the rule that triggered the match during the most recent
+ * policy evaluation. Must be read inside an action callback when using plcs_evaluate_buffer,
+ * as it is reset at the start of each policy evaluation.
+ * @return const char* NULL if no match occurred or the matching node has no description.
+ */
+const char *plcs_eval_ctx_get_matched_description(void);

From 1c06791e8a00cb60d68bff9a6b93fd42364a78a5 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 3 Jun 2026 16:00:30 -0400
Subject: [PATCH 06/14] formatting

---
 c/src/eval_ctx.c                              |  10 +-
 c/src/eval_ctx.h                              |   5 +-
 c/src/test/test_evaluator.c                   |  26 ++-
 .../test/test_matched_description_policies.h  | 193 +++++++-----------
 4 files changed, 108 insertions(+), 126 deletions(-)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index dd4049c..e5b3148 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -217,11 +217,17 @@ void plcs_eval_ctx_set_matched_description(const char *description) {
   ctx.matched_description = description;
 }
 
-void plcs_eval_ctx_set_matched_description_with_evaluation_details(const char *rule_description, const char* evaluator_description) {
+void plcs_eval_ctx_set_matched_description_with_evaluation_details(
+    const char *rule_description,
+    const char *evaluator_description
+) {
   if (!rule_description || !evaluator_description) {
     return;
   }
-  snprintf(description_with_evaluation_details, sizeof(description_with_evaluation_details), "%s: %s", rule_description, evaluator_description);
+  snprintf(
+      description_with_evaluation_details, sizeof(description_with_evaluation_details), "%s: %s", rule_description,
+      evaluator_description
+  );
   ctx.matched_description = description_with_evaluation_details;
 }
 
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index fba445d..efa0ce3 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -176,4 +176,7 @@ void plcs_eval_ctx_set_matched_description(const char *description);
  * @param rule_description description of the matched composite rule.
  * @param evaluator_description description of the specific evaluator condition that triggered the match.
  */
-void plcs_eval_ctx_set_matched_description_with_evaluation_details(const char *rule_description, const char *evaluator_description);
+void plcs_eval_ctx_set_matched_description_with_evaluation_details(
+    const char *rule_description,
+    const char *evaluator_description
+);
diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index f7f3fdb..2ea4339 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -1067,7 +1067,9 @@ static void matched_description_test_setup(void) {
 UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
-  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon");
+  plcs_eval_ctx_set_str_eval_param(
+      PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon"
+  );
 
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
 
@@ -1091,8 +1093,9 @@ UTEST(evaluator_matched_description, nested_or_leaf_no_combination) {
 /*
  * Policy [1]: "Flat OR no runtime" (runtime=all)
  * Tree: OR[Skip processes launched from OS system binary directories]
- *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/']
- *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting with '/sbin/']
+ *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting
+ * with '/bin/'] EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path
+ * starting with '/sbin/']
  *
  * No AND wrapper, no outer OR — EvaluatorNode description captured directly.
  */
@@ -1103,7 +1106,13 @@ UTEST(evaluator_matched_description, flat_or_leaf_captured_directly) {
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
 
   ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"), 0);
+  ASSERT_EQ(
+      strcmp(
+          g_captured_description,
+          "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"
+      ),
+      0
+  );
 }
 
 UTEST(evaluator_matched_description, flat_or_second_leaf) {
@@ -1113,7 +1122,14 @@ UTEST(evaluator_matched_description, flat_or_second_leaf) {
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
 
   ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "Skip process launched from a system binary directory: matched on entry point file path starting with '/usr/bin/'"), 0);
+  ASSERT_EQ(
+      strcmp(
+          g_captured_description,
+          "Skip process launched from a system binary directory: matched on entry point file path starting with "
+          "'/usr/bin/'"
+      ),
+      0
+  );
 }
 
 /*
diff --git a/c/src/test/test_matched_description_policies.h b/c/src/test/test_matched_description_policies.h
index 3eb9782..f90b189 100644
--- a/c/src/test/test_matched_description_policies.h
+++ b/c/src/test/test_matched_description_policies.h
@@ -2,123 +2,80 @@
 #include <stdint.h>
 
 static const uint8_t test_matched_description_policies[] = {
-  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00,
-  0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
-  0x98, 0x02, 0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
-  0x7e, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00,
-  0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
-  0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c,
-  0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x6e, 0xfd, 0xff, 0xff,
-  0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-  0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
-  0x6a, 0x76, 0x6d, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20,
-  0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00,
-  0x98, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
-  0x42, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00,
-  0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20,
-  0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00,
-  0xd4, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
-  0xca, 0xfb, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
-  0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67,
-  0x00, 0x00, 0x00, 0x00, 0xba, 0xfb, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
-  0x1c, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
-  0x12, 0xfc, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63,
-  0x68, 0x65, 0x64, 0x20, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d,
-  0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0x06, 0xfc, 0xff, 0xff,
-  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x0f, 0x00, 0x00, 0x00,
-  0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e,
-  0x41, 0x70, 0x70, 0x00, 0xba, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-  0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-  0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x46, 0x6c, 0x61, 0x74,
-  0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69,
-  0x6d, 0x65, 0x00, 0x00, 0xae, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
-  0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00,
-  0x12, 0x00, 0x00, 0x00, 0x46, 0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20,
-  0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00, 0x00,
-  0xdc, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
-  0x86, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
-  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00,
-  0x1c, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74,
-  0x65, 0x6d, 0x20, 0x70, 0x61, 0x74, 0x68, 0x20, 0x67, 0x72, 0x6f, 0x75,
-  0x70, 0x00, 0x00, 0x00, 0x1c, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
-  0x04, 0x00, 0x00, 0x00, 0x12, 0xfd, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00,
-  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x15, 0x00, 0x00, 0x00,
-  0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
-  0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00,
-  0x06, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01,
-  0x09, 0x00, 0x00, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e,
-  0x2f, 0x00, 0x00, 0x00, 0x70, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
-  0x04, 0x00, 0x00, 0x00, 0x66, 0xfd, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
-  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x00, 0x00,
-  0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
-  0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x56, 0xfd, 0xff, 0xff,
-  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x05, 0x00, 0x00, 0x00,
-  0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00,
-  0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
-  0x70, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-  0x28, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74,
-  0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e,
-  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0f, 0x00,
-  0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
-  0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
-  0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
-  0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f,
-  0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-  0x6e, 0x00, 0x00, 0x00, 0x3c, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02,
-  0x04, 0x00, 0x00, 0x00, 0xe6, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
-  0x24, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00,
-  0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f,
-  0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00,
-  0x80, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
-  0x76, 0xfe, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
-  0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67,
-  0x00, 0x00, 0x00, 0x00, 0x66, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
-  0xc8, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00,
-  0x72, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
-  0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00,
-  0x20, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74,
-  0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e,
-  0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0c, 0xff, 0xff, 0xff,
-  0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x02, 0xff, 0xff, 0xff,
-  0x20, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-  0x0d, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
-  0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0xee, 0xfe, 0xff, 0xff,
-  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00,
-  0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x54, 0xff, 0xff, 0xff,
-  0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
-  0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00,
-  0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
-  0x02, 0x00, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
-  0x0f, 0x00, 0x00, 0x00, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72,
-  0x61, 0x20, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x00, 0x9c, 0xff, 0xff, 0xff,
-  0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x92, 0xff, 0xff, 0xff,
-  0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-  0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
-  0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x74, 0x6f,
-  0x6f, 0x6c, 0x73, 0x00, 0x86, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
-  0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
-  0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00,
-  0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00,
-  0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00,
-  0x34, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-  0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
-  0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65,
-  0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x0c, 0x00, 0x0a, 0x00,
-  0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x0a, 0x04, 0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
-  0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
-  0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-  0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61,
-  0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
+    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
+    0x00, 0x03, 0x00, 0x00, 0x00, 0x98, 0x02, 0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7e, 0xfd,
+    0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18,
+    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b,
+    0x00, 0x00, 0x00, 0x00, 0x6e, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x0c, 0x00,
+    0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x98,
+    0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x42, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00,
+    0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00,
+    0x00, 0x00, 0xd4, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xca, 0xfb, 0xff, 0xff, 0x24,
+    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
+    0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0xba, 0xfb, 0xff,
+    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x1c, 0xfc,
+    0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x12, 0xfc, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
+    0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0x06, 0xfc, 0xff,
+    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x0f, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78,
+    0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0xba, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x60,
+    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
+    0x46, 0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00,
+    0x00, 0xae, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00,
+    0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x12, 0x00, 0x00, 0x00, 0x46,
+    0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00, 0x00,
+    0xdc, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x86, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x1c, 0x00,
+    0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x70, 0x61, 0x74, 0x68, 0x20, 0x67,
+    0x72, 0x6f, 0x75, 0x70, 0x00, 0x00, 0x00, 0x1c, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
+    0x12, 0xfd, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x15, 0x00, 0x00,
+    0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62,
+    0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x06, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x09,
+    0x00, 0x00, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x70, 0xfd, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x66, 0xfd, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x00, 0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74,
+    0x68, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x56, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x08, 0x01, 0x05, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00,
+    0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00,
+    0x00, 0x01, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64,
+    0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x0a, 0x00, 0x10,
+    0x00, 0x0f, 0x00, 0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d,
+    0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62,
+    0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x3c, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04,
+    0x00, 0x00, 0x00, 0xe6, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00,
+    0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73,
+    0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00,
+    0x00, 0x00, 0x80, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x76, 0xfe, 0xff, 0xff, 0x24,
+    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
+    0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x66, 0xfe, 0xff,
+    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0xc8, 0xfe,
+    0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x72, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00,
+    0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69,
+    0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0c, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00,
+    0x00, 0x00, 0x02, 0xff, 0xff, 0xff, 0x20, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x0d,
+    0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20, 0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00,
+    0xee, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00, 0x6b, 0x61, 0x66,
+    0x6b, 0x61, 0x00, 0x00, 0x00, 0x54, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
+    0x0f, 0x00, 0x00, 0x00, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x67, 0x72, 0x6f, 0x75, 0x70,
+    0x00, 0x9c, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x92, 0xff, 0xff, 0xff, 0x28, 0x00,
+    0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68,
+    0x65, 0x64, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00,
+    0x86, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67,
+    0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74,
+    0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00, 0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00,
+    0x0a, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00,
+    0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44,
+    0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x0c, 0x00, 0x0a, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
+    0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65,
+    0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d,
+    0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
 };
 static const unsigned int test_matched_description_policies_len = 1412;

From bea73036315c78d7ec8aedf9da2466d572887a53 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Thu, 11 Jun 2026 14:43:40 -0400
Subject: [PATCH 07/14] add stdio.h include

---
 c/src/eval_ctx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index e5b3148..5ebc525 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -12,6 +12,7 @@
 #include "eval_ctx.h"
 
 #include <stdbool.h>
+#include <stdio.h>
 
 static plcs_eval_ctx ctx;
 static bool plcs_eval_ctx_initialized = false;

From d60f56c0d2da97238b7aa77ad4d9fecaca084984 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Thu, 11 Jun 2026 17:14:07 -0400
Subject: [PATCH 08/14] change logic to match description of innermost node

---
 c/src/eval_ctx.c            | 14 --------------
 c/src/eval_ctx.h            |  9 ---------
 c/src/evaluator.c           | 12 ++++++------
 c/src/test/test_evaluator.c |  9 ++++-----
 4 files changed, 10 insertions(+), 34 deletions(-)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index 5ebc525..4041582 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -16,7 +16,6 @@
 
 static plcs_eval_ctx ctx;
 static bool plcs_eval_ctx_initialized = false;
-static char description_with_evaluation_details[1024];
 
 plcs_errors
 plcs_eval_ctx_register_str_evaluator(plcs_string_evaluator_function_ptr func_ptr, plcs_string_evaluators ix) {
@@ -218,19 +217,6 @@ void plcs_eval_ctx_set_matched_description(const char *description) {
   ctx.matched_description = description;
 }
 
-void plcs_eval_ctx_set_matched_description_with_evaluation_details(
-    const char *rule_description,
-    const char *evaluator_description
-) {
-  if (!rule_description || !evaluator_description) {
-    return;
-  }
-  snprintf(
-      description_with_evaluation_details, sizeof(description_with_evaluation_details), "%s: %s", rule_description,
-      evaluator_description
-  );
-  ctx.matched_description = description_with_evaluation_details;
-}
 
 plcs_errors plcs_eval_ctx_peek_last_error(void) {
   return ctx.error;
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index efa0ce3..e3207bd 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -171,12 +171,3 @@ const char *plcs_eval_ctx_get_matched_description(void);
  */
 void plcs_eval_ctx_set_matched_description(const char *description);
 
-/**
- * @brief Sets matched_description to "{rule_description}: {evaluator_description}".
- * @param rule_description description of the matched composite rule.
- * @param evaluator_description description of the specific evaluator condition that triggered the match.
- */
-void plcs_eval_ctx_set_matched_description_with_evaluation_details(
-    const char *rule_description,
-    const char *evaluator_description
-);
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index 5cc47bf..bc094a9 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -172,6 +172,11 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
   if (!node) {
     return;
   }
+  // A more specific description from a deeper node takes priority.
+  const char *existing = plcs_eval_ctx_get_matched_description();
+  if (existing && existing[0] != '\0') {
+    return;
+  }
   const char *description = NULL;
   switch (dd_ns(NodeTypeWrapper_node_type)(node)) {
     case dd_ns(NodeType_CompositeNode):
@@ -182,12 +187,7 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
       break;
   }
   if (description && description[0] != '\0') {
-    const char *existing = plcs_eval_ctx_get_matched_description();
-    if (dd_ns(NodeTypeWrapper_node_type)(node) == dd_ns(NodeType_CompositeNode) && existing && existing[0] != '\0') {
-      plcs_eval_ctx_set_matched_description_with_evaluation_details(description, existing);
-    } else {
-      plcs_eval_ctx_set_matched_description(description);
-    }
+    plcs_eval_ctx_set_matched_description(description);
   }
 }
 
diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index 2ea4339..4424744 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -1061,8 +1061,8 @@ static void matched_description_test_setup(void) {
  *             EvaluatorNode[matched Cassandra tools]
  *           EvaluatorNode[matched kafka]  <- condition with 1 value
  *
- * When CassandraDaemon matches: OR[Cassandra group] captures "matched CassandraDaemon",
- * then outer OR combines it: "Cassandra group: matched CassandraDaemon".
+ * When CassandraDaemon matches: OR[Cassandra group] short-circuits and captures
+ * "matched CassandraDaemon" from the leaf. Outer OR does not overwrite it.
  */
 UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
   matched_description_test_setup();
@@ -1074,11 +1074,10 @@ UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
 
   ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "Cassandra group: matched CassandraDaemon"), 0);
+  ASSERT_EQ(strcmp(g_captured_description, "matched CassandraDaemon"), 0);
 }
 
-/* Same policy, single-value condition: outer OR short-circuits on EvaluatorNode directly,
- * no combination — just the leaf description. */
+/* Same policy, single-value condition: outer OR short-circuits on EvaluatorNode directly. */
 UTEST(evaluator_matched_description, nested_or_leaf_no_combination) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");

From c2e7b0fea80c2851273f5bf0509308327736e7ff Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Tue, 23 Jun 2026 13:25:24 -0400
Subject: [PATCH 09/14] derive human-readable match description from policy
 tree structure

---
 c/src/eval_ctx.h  |   1 +
 c/src/evaluator.c | 134 +++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 127 insertions(+), 8 deletions(-)

diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index e3207bd..84c7949 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -171,3 +171,4 @@ const char *plcs_eval_ctx_get_matched_description(void);
  */
 void plcs_eval_ctx_set_matched_description(const char *description);
 
+
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index bc094a9..6e4fd7a 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -20,6 +20,8 @@
 #include "wire/evaluation_result.h"
 #define PLCS_MAX_EVAL_DEPTH 64
 
+static char synth_buf[512];
+
 plcs_evaluation_result evaluate_rules(dd_ns(NodeTypeWrapper_table_t) node, int depth);
 
 plcs_evaluation_result evaluate_string(dd_ns(StrEvaluator_table_t) eval_str, const char *description) {
@@ -168,6 +170,67 @@ plcs_evaluation_result DoOper(dd_ns(BoolOperation_enum_t) oper, plcs_evaluation_
   }
 }
 
+static const char *cmp_op_label(dd_ns(CmpTypeSTR_enum_t) cmp) {
+  switch (cmp) {
+    case dd_ns(CmpTypeSTR_CMP_EXACT):    return "matches";
+    case dd_ns(CmpTypeSTR_CMP_PREFIX):   return "starts with";
+    case dd_ns(CmpTypeSTR_CMP_SUFFIX):   return "ends with";
+    case dd_ns(CmpTypeSTR_CMP_CONTAINS): return "contains";
+    case dd_ns(CmpTypeSTR_CMP_WILDCARD): return "matches (wildcard)";
+    default:                             return "?";
+  }
+}
+
+static const char *str_eval_field_label(dd_ns(StringEvaluators_enum_t) id) {
+  switch (id) {
+    case dd_ns(StringEvaluators_COMPONENT):                 return "component";
+    case dd_ns(StringEvaluators_PROCESS_EXE):               return "executable";
+    case dd_ns(StringEvaluators_PROCESS_EXE_FULL_PATH):     return "executable full path";
+    case dd_ns(StringEvaluators_PROCESS_BASEDIR_PATH):      return "process base directory";
+    case dd_ns(StringEvaluators_PROCESS_ARGV):              return "command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_CWD):               return "process working directory";
+    case dd_ns(StringEvaluators_RUNTIME_LANGUAGE):          return "language";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_FILE):  return "entry point file";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_JAR):   return "entry point JAR";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_CLASS): return "entry point class";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_PACKAGE): return "entry point package";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_MODULE): return "entry point module";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_SOURCE): return "entry point source file";
+    case dd_ns(StringEvaluators_RUNTIME_DOPTION):           return "runtime -D option";
+    case dd_ns(StringEvaluators_RUNTIME_VERSION):           return "runtime version";
+    case dd_ns(StringEvaluators_LIBC_FLAVOR):               return "libc flavor";
+    case dd_ns(StringEvaluators_LIBC_VERSION):              return "libc version";
+    case dd_ns(StringEvaluators_MACHINE_ARCHITECTURE):      return "machine architecture";
+    case dd_ns(StringEvaluators_HOST_NAME):                 return "host name";
+    case dd_ns(StringEvaluators_HOST_IP):                   return "host IP";
+    case dd_ns(StringEvaluators_OS):                        return "operating system";
+    case dd_ns(StringEvaluators_OS_DISTRO):                 return "OS distribution";
+    case dd_ns(StringEvaluators_OS_DISTRO_VERSION):         return "OS distribution version";
+    case dd_ns(StringEvaluators_OS_DISTRO_CODENAME):        return "OS distribution codename";
+    case dd_ns(StringEvaluators_OS_KERNEL_VERSION):         return "OS kernel version";
+    case dd_ns(StringEvaluators_OS_KERNEL_NAME):            return "OS kernel name";
+    case dd_ns(StringEvaluators_OS_USER):                   return "OS user";
+    case dd_ns(StringEvaluators_OS_USER_GROUP):             return "OS user group";
+    case dd_ns(StringEvaluators_CONTAINER_IMAGE):           return "container image";
+    case dd_ns(StringEvaluators_CONTAINER_ID):              return "container ID";
+    case dd_ns(StringEvaluators_IIS_APPLICATION_POOL):      return "IIS application pool";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_0):            return "command-line argument 0";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_1):            return "command-line argument 1";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_2):            return "command-line argument 2";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_3):            return "command-line argument 3";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_4):            return "command-line argument 4";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_5):            return "command-line argument 5";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N):            return "last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_2):          return "second to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_3):          return "third to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_4):          return "fourth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_5):          return "fifth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_6):          return "sixth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ENVAR):             return "process environment variable";
+    default:                                                return dd_ns(StringEvaluators_name)(id);
+  }
+}
+
 static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) node) {
   if (!node) {
     return;
@@ -179,12 +242,39 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
   }
   const char *description = NULL;
   switch (dd_ns(NodeTypeWrapper_node_type)(node)) {
-    case dd_ns(NodeType_CompositeNode):
-      description = dd_ns(CompositeNode_description)(dd_ns(NodeTypeWrapper_node)(node));
+    case dd_ns(NodeType_CompositeNode): {
+      dd_ns(CompositeNode_table_t) comp = dd_ns(NodeTypeWrapper_node)(node);
+      description = dd_ns(CompositeNode_description)(comp);
+      if ((!description || description[0] == '\0') &&
+          dd_ns(CompositeNode_op)(comp) == dd_ns(BoolOperation_BOOL_NOT)) {
+        dd_ns(NodeTypeWrapper_vec_t) children = dd_ns(CompositeNode_children)(comp);
+        if (children && dd_ns(NodeTypeWrapper_vec_len)(children) == 1) {
+          capture_matched_description(dd_ns(NodeTypeWrapper_vec_at)(children, 0));
+        }
+        return;
+      }
       break;
-    case dd_ns(NodeType_EvaluatorNode):
-      description = dd_ns(EvaluatorNode_description)(dd_ns(NodeTypeWrapper_node)(node));
+    }
+    case dd_ns(NodeType_EvaluatorNode): {
+      dd_ns(EvaluatorNode_table_t) eval_node = dd_ns(NodeTypeWrapper_node)(node);
+      description = dd_ns(EvaluatorNode_description)(eval_node);
+      if (!description || description[0] == '\0') {
+        dd_ns(EvaluatorType_union_t) eval = dd_ns(EvaluatorNode_eval_union)(eval_node);
+        if (eval.type == dd_ns(EvaluatorType_StrEvaluator)) {
+          dd_ns(StrEvaluator_table_t) str_eval = eval.value;
+          const char *field = str_eval_field_label(dd_ns(StrEvaluator_id)(str_eval));
+          const char *op    = cmp_op_label(dd_ns(StrEvaluator_cmp)(str_eval));
+          const char *value = dd_ns(StrEvaluator_value)(str_eval);
+          snprintf(
+              synth_buf, sizeof(synth_buf),
+              "%s %s '%s'", field ? field : "?", op, value ? value : ""
+          );
+          plcs_eval_ctx_set_matched_description(synth_buf);
+          return;
+        }
+      }
       break;
+    }
   }
   if (description && description[0] != '\0') {
     plcs_eval_ctx_set_matched_description(description);
@@ -227,21 +317,34 @@ plcs_evaluation_result composite_evaluator(dd_ns(CompositeNode_table_t) node, in
   }
 
   // keep iterating recursively over the tree
+  dd_ns(NodeTypeWrapper_table_t) last_true_child = NULL;
   for (size_t ix = 0; ix < children_len; ++ix) {
-    res = DoOper(oper, res, evaluate_rules(dd_ns(NodeTypeWrapper_vec_at)(children, ix), depth + 1));
+    dd_ns(NodeTypeWrapper_table_t) child = dd_ns(NodeTypeWrapper_vec_at)(children, ix);
+    plcs_evaluation_result child_res = evaluate_rules(child, depth + 1);
+    res = DoOper(oper, res, child_res);
 
-    // short circuit
+    // short circuit OR: capture the child that caused TRUE
     if (oper == dd_ns(BoolOperation_BOOL_OR) && res == PLCS_EVAL_RESULT_TRUE) {
-      capture_matched_description(dd_ns(NodeTypeWrapper_vec_at)(children, ix));
+      capture_matched_description(child);
       return res;
     }
 
-    // short circuit
+    // track last TRUE child for AND description capture
+    if (oper == dd_ns(BoolOperation_BOOL_AND) && child_res == PLCS_EVAL_RESULT_TRUE) {
+      last_true_child = child;
+    }
+
+    // short circuit AND
     if (oper == dd_ns(BoolOperation_BOOL_AND) && res == PLCS_EVAL_RESULT_FALSE) {
       return res;
     }
   }
 
+  // AND succeeded: capture description of last TRUE child (no-op if OR already set one)
+  if (oper == dd_ns(BoolOperation_BOOL_AND) && last_true_child) {
+    capture_matched_description(last_true_child);
+  }
+
   return res;
 }
 
@@ -321,6 +424,21 @@ plcs_errors evaluate_policy(dd_ns(Policy_table_t) policy) {
     capture_matched_description(rules);
   }
 
+  // Prepend [skip]/[allow] prefix from the first action when no prefix is present yet.
+  const char *desc = plcs_eval_ctx_get_matched_description();
+  if (desc && desc[0] != '\0' && desc[0] != '[' &&
+      actions && dd_ns(Action_vec_len)(actions) > 0) {
+    dd_ns(Action_table_t) first_action = dd_ns(Action_vec_at)(actions, 0);
+    if (first_action) {
+      const char *prefix =
+          dd_ns(Action_action)(first_action) == dd_ns(ActionId_INJECT_DENY) ? "[skip] " : "[allow] ";
+      char temp[512];
+      snprintf(temp, sizeof(temp), "%s%s", prefix, desc);
+      snprintf(synth_buf, sizeof(synth_buf), "%s", temp);
+      plcs_eval_ctx_set_matched_description(synth_buf);
+    }
+  }
+
   // perform actions given evaluation result
   return perform_actions(eval_res, actions);
 }

From bdcabf13590649fe9ec54168be64dc215b063aed Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Tue, 23 Jun 2026 14:21:44 -0400
Subject: [PATCH 10/14] simplify test cases

---
 c/src/test/test_evaluator.c                   | 130 ++++---------
 .../test/test_matched_description_policies.h  | 174 ++++++++++--------
 .../test_matched_description.json             |  38 ++--
 3 files changed, 154 insertions(+), 188 deletions(-)

diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index 4424744..37a8b06 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -1005,36 +1005,15 @@ UTEST(evaluator_integration, evaluate_generated_header_if_available) {
 #endif
 }
 
-/*
- * End-to-end matched_description tests using a generated FlatBuffers header.
- *
- * Policies are defined in test_matched_description.json and compiled to
- * test_matched_description_policies.h. Three policies exercise the three
- * distinct capture paths:
- *   [0] Nested OR combination  (runtime=jvm, 2 conditions)
- *   [1] Flat OR, no runtime    (runtime=all, 1 condition, 2 values)
- *   [2] AND fallback           (runtime=jvm, 1 condition, 1 value)
- *
- * matched_description is reset at the start of each evaluate_policy() call,
- * so it must be read inside the action callback, which only saves it when
- * the evaluation result is PLCS_EVAL_RESULT_TRUE.
- */
+/* End-to-end matched_description tests. Policies defined in test_matched_description.json. */
 static const char *g_captured_description = NULL;
 
 static plcs_errors test_action_capture(
-    plcs_evaluation_result res,
-    char *values[],
-    size_t value_len,
-    const char *description,
-    int action_id
-) {
-  (void)values;
-  (void)value_len;
-  (void)description;
-  (void)action_id;
-  if (res == PLCS_EVAL_RESULT_TRUE) {
+    plcs_evaluation_result res, char *values[], size_t value_len,
+    const char *description, int action_id) {
+  (void)values; (void)value_len; (void)description; (void)action_id;
+  if (res == PLCS_EVAL_RESULT_TRUE)
     g_captured_description = plcs_eval_ctx_get_matched_description();
-  }
   return PLCS_ESUCCESS;
 }
 
@@ -1051,113 +1030,66 @@ static void matched_description_test_setup(void) {
   plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_PROCESS_EXE_FULL_PATH);
 }
 
-/*
- * Policy [0]: "Nested OR combination" (runtime=jvm)
- * Tree: AND[Nested OR combination]
- *         EvaluatorNode[Runtime matching]
- *         OR[Nested OR combination]
- *           OR[Cassandra group]        <- condition with 2 values
- *             EvaluatorNode[matched CassandraDaemon]
- *             EvaluatorNode[matched Cassandra tools]
- *           EvaluatorNode[matched kafka]  <- condition with 1 value
- *
- * When CassandraDaemon matches: OR[Cassandra group] short-circuits and captures
- * "matched CassandraDaemon" from the leaf. Outer OR does not overwrite it.
- */
+#define ASSERT_DESCRIPTION(expected) \
+  ASSERT_TRUE(g_captured_description != NULL); \
+  ASSERT_EQ(strcmp(g_captured_description, (expected)), 0)
+
+/* Policy[0]: inner OR short-circuits, outer OR does not overwrite */
 UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
-  plcs_eval_ctx_set_str_eval_param(
-      PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon"
-  );
-
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon");
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
-  ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "matched CassandraDaemon"), 0);
+  ASSERT_DESCRIPTION("[skip] Apache Cassandra — JVM main class matches 'org.apache.cassandra.service.CassandraDaemon'");
 }
 
-/* Same policy, single-value condition: outer OR short-circuits on EvaluatorNode directly. */
+/* Policy[0]: single-value condition captured directly by OR */
 UTEST(evaluator_matched_description, nested_or_leaf_no_combination) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_PROCESS_EXE, "kafka");
-
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
-  ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "matched kafka"), 0);
+  ASSERT_DESCRIPTION("[skip] Apache Kafka — executable name matches 'kafka'");
 }
 
-/*
- * Policy [1]: "Flat OR no runtime" (runtime=all)
- * Tree: OR[Skip processes launched from OS system binary directories]
- *         EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path starting
- * with '/bin/'] EvaluatorNode[Skip process launched from a system binary directory: matched on entry point file path
- * starting with '/sbin/']
- *
- * No AND wrapper, no outer OR — EvaluatorNode description captured directly.
- */
-UTEST(evaluator_matched_description, flat_or_leaf_captured_directly) {
+/* Policy[1]: flat OR, first leaf matches */
+UTEST(evaluator_matched_description, flat_or_first_leaf) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_FILE, "/bin/bash");
-
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
-  ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(
-      strcmp(
-          g_captured_description,
-          "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"
-      ),
-      0
-  );
+  ASSERT_DESCRIPTION("[skip] OS system binary — entrypoint file starts with '/bin/'");
 }
 
+/* Policy[1]: flat OR, second leaf matches */
 UTEST(evaluator_matched_description, flat_or_second_leaf) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_FILE, "/usr/bin/python");
-
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
-  ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(
-      strcmp(
-          g_captured_description,
-          "Skip process launched from a system binary directory: matched on entry point file path starting with "
-          "'/usr/bin/'"
-      ),
-      0
-  );
+  ASSERT_DESCRIPTION("[skip] OS system binary — entrypoint file starts with '/usr/bin/'");
 }
 
-/*
- * Policy [2]: "AND fallback" (runtime=jvm, single condition with 1 value)
- * Tree: AND[AND fallback]
- *         EvaluatorNode[Runtime matching]
- *         EvaluatorNode[matched org.example.App]
- *
- * AND never calls capture_matched_description in its loop. The post-evaluation
- * fallback in evaluate_policy fires and captures the root AND node's description.
- */
-UTEST(evaluator_matched_description, and_fallback_captures_root_description) {
+/* Policy[2]: AND captures description of its last TRUE child */
+UTEST(evaluator_matched_description, and_captures_last_true_child_description) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.example.App");
-
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
-  ASSERT_TRUE(g_captured_description != NULL);
-  ASSERT_EQ(strcmp(g_captured_description, "AND fallback"), 0);
+  ASSERT_DESCRIPTION("[skip] Example App — JVM main class matches 'org.example.App'");
 }
 
-/* No policy matches: g_captured_description is never set to a non-NULL value. */
+/* No policy matches: description stays NULL */
 UTEST(evaluator_matched_description, no_match_description_is_null) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "com.mycompany.MyApp");
-
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-
   ASSERT_TRUE(g_captured_description == NULL);
 }
+
+/* Policy[3]: no descriptions on any node — engine synthesizes from field + op + value */
+UTEST(evaluator_matched_description, synthesized_description) {
+  matched_description_test_setup();
+  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_PROCESS_EXE_FULL_PATH, "/opt/myapp/bin");
+  plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
+  ASSERT_DESCRIPTION("[skip] executable full path starts with '/opt/'");
+}
diff --git a/c/src/test/test_matched_description_policies.h b/c/src/test/test_matched_description_policies.h
index f90b189..15e3879 100644
--- a/c/src/test/test_matched_description_policies.h
+++ b/c/src/test/test_matched_description_policies.h
@@ -2,80 +2,102 @@
 #include <stdint.h>
 
 static const uint8_t test_matched_description_policies[] = {
-    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
-    0x00, 0x03, 0x00, 0x00, 0x00, 0x98, 0x02, 0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x7e, 0xfd,
-    0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x18,
-    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b,
-    0x00, 0x00, 0x00, 0x00, 0x6e, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x0c, 0x00,
-    0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00, 0x00, 0x00, 0x98,
-    0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x42, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00,
-    0x00, 0x0c, 0x00, 0x00, 0x00, 0x41, 0x4e, 0x44, 0x20, 0x66, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x00, 0x00,
-    0x00, 0x00, 0xd4, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xca, 0xfb, 0xff, 0xff, 0x24,
-    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
-    0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0xba, 0xfb, 0xff,
-    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x1c, 0xfc,
-    0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x12, 0xfc, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20,
-    0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0x06, 0xfc, 0xff,
-    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x0f, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78,
-    0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0xba, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x60,
-    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
-    0x46, 0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00,
-    0x00, 0xae, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00,
-    0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x12, 0x00, 0x00, 0x00, 0x46,
-    0x6c, 0x61, 0x74, 0x20, 0x4f, 0x52, 0x20, 0x6e, 0x6f, 0x20, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x00, 0x00,
-    0xdc, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x86, 0xfd, 0xff, 0xff, 0x0c, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00, 0x1c, 0x00,
-    0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x70, 0x61, 0x74, 0x68, 0x20, 0x67,
-    0x72, 0x6f, 0x75, 0x70, 0x00, 0x00, 0x00, 0x1c, 0xfd, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
-    0x12, 0xfd, 0xff, 0xff, 0x28, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x15, 0x00, 0x00,
-    0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62,
-    0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x06, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x09,
-    0x00, 0x00, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x70, 0xfd, 0xff, 0xff,
-    0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x66, 0xfd, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x01, 0x11, 0x00, 0x00, 0x00, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74,
-    0x68, 0x20, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0x56, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x08, 0x01, 0x05, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00,
-    0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00,
-    0x00, 0x01, 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64,
-    0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x0a, 0x00, 0x10,
-    0x00, 0x0f, 0x00, 0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d,
-    0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62,
-    0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x3c, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04,
-    0x00, 0x00, 0x00, 0xe6, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00,
-    0x02, 0x00, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73,
-    0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00,
-    0x00, 0x00, 0x80, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x76, 0xfe, 0xff, 0xff, 0x24,
-    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74,
-    0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x66, 0xfe, 0xff,
-    0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0xc8, 0xfe,
-    0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x72, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x6c, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00,
-    0x15, 0x00, 0x00, 0x00, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x20, 0x4f, 0x52, 0x20, 0x63, 0x6f, 0x6d, 0x62, 0x69,
-    0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0c, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00,
-    0x00, 0x00, 0x02, 0xff, 0xff, 0xff, 0x20, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x0d,
-    0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20, 0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00,
-    0xee, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00, 0x6b, 0x61, 0x66,
-    0x6b, 0x61, 0x00, 0x00, 0x00, 0x54, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x88, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00,
-    0x0f, 0x00, 0x00, 0x00, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x67, 0x72, 0x6f, 0x75, 0x70,
-    0x00, 0x9c, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x92, 0xff, 0xff, 0xff, 0x28, 0x00,
-    0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00, 0x00, 0x6d, 0x61, 0x74, 0x63, 0x68,
-    0x65, 0x64, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00,
-    0x86, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67,
-    0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74,
-    0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00, 0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00,
-    0x0a, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x17, 0x00, 0x00,
-    0x00, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x64, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44,
-    0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x0c, 0x00, 0x0a, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a,
-    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e,
-    0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65,
-    0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d,
-    0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
+    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+    0x04, 0x00, 0x00, 0x00, 0xbc, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
+    0x5e, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+    0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
+    0x61, 0x6c, 0x6c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc4, 0xf9, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
+    0x04, 0x00, 0x00, 0x00, 0xba, 0xf9, 0xff, 0xff, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0xf9, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x01,
+    0x05, 0x00, 0x00, 0x00, 0x2f, 0x6f, 0x70, 0x74, 0x2f, 0x00, 0x00, 0x00, 0xe2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+    0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00,
+    0xc2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
+    0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x12, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
+    0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00, 0x68, 0xfa, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x42, 0xfb, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00,
+    0xa8, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfa, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
+    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20,
+    0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x46, 0xfa, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0xf0, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
+    0x04, 0x00, 0x00, 0x00, 0xe6, 0xfa, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41,
+    0x70, 0x70, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61, 0x73,
+    0x73, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70,
+    0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x27, 0x00, 0xba, 0xfa, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04,
+    0x0f, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00,
+    0x52, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x2c, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79,
+    0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72,
+    0x69, 0x65, 0x73, 0x00, 0x42, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x23, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e,
+    0x61, 0x72, 0x79, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x69, 0x65, 0x73, 0x00, 0xf8, 0xfb, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0xd2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
+    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x28, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x1e, 0xfc, 0xff, 0xff,
+    0x54, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x43, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
+    0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20,
+    0xe2, 0x80, 0x94, 0x20, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x20,
+    0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69,
+    0x6e, 0x2f, 0x27, 0x00, 0xf6, 0xfb, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x09, 0x00, 0x00, 0x00,
+    0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0xa8, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
+    0x04, 0x00, 0x00, 0x00, 0x9e, 0xfc, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
+    0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69,
+    0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
+    0x27, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x27, 0x00, 0x72, 0xfc, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01,
+    0x05, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x08, 0x00, 0x04, 0x00,
+    0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x94, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x3c, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
+    0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
+    0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0f, 0x00, 0x08, 0x00, 0x04, 0x00,
+    0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
+    0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
+    0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20,
+    0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xc4, 0xfd, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
+    0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00,
+    0x18, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x0e, 0xfe, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
+    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20,
+    0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0xb6, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x60, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02,
+    0x04, 0x00, 0x00, 0x00, 0x3a, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
+    0x02, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
+    0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20,
+    0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xb4, 0xfe, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xaa, 0xfe, 0xff, 0xff, 0x48, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x37, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
+    0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62,
+    0x6c, 0x65, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6b, 0x61, 0x66,
+    0x6b, 0x61, 0x27, 0x00, 0x76, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00,
+    0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x24, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
+    0x56, 0xff, 0xff, 0xff, 0x64, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x53, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
+    0x64, 0x72, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61,
+    0x73, 0x73, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e,
+    0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f,
+    0x6c, 0x73, 0x27, 0x00, 0x3e, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00,
+    0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61,
+    0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00, 0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00,
+    0x0a, 0x00, 0x00, 0x00, 0x7c, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x61, 0x00, 0x00, 0x00,
+    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
+    0x64, 0x72, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61,
+    0x73, 0x73, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63,
+    0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+    0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x27, 0x00, 0x0a, 0x00,
+    0x0c, 0x00, 0x0a, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04,
+    0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
+    0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64,
+    0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
 };
-static const unsigned int test_matched_description_policies_len = 1412;
+const unsigned int test_matched_description_policies_len = 1932;
diff --git a/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json b/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json
index 593dda2..520da87 100644
--- a/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json
+++ b/go/examples/example_json_to_hardcoded_injector_policies/test_matched_description.json
@@ -1,77 +1,89 @@
 {
   "policies": [
     {
-      "description": "Nested OR combination",
+      "description": "[skip] Apache Cassandra or Apache Kafka",
       "skip": true,
       "runtime": "jvm",
       "conditions": [
         {
-          "description": "Cassandra group",
           "values": [
             {
               "cmp_strategy": "equals",
               "value": "org.apache.cassandra.service.CassandraDaemon",
               "value_type": "class",
-              "description": "matched CassandraDaemon"
+              "description": "[skip] Apache Cassandra — JVM main class matches 'org.apache.cassandra.service.CassandraDaemon'"
             },
             {
               "cmp_strategy": "prefix",
               "value": "org.apache.cassandra.tools",
               "value_type": "class",
-              "description": "matched Cassandra tools"
+              "description": "[skip] Apache Cassandra — JVM main class starts with 'org.apache.cassandra.tools'"
             }
           ]
         },
         {
-          "description": "Kafka group",
+          "description": "[skip] Apache Kafka",
           "values": [
             {
               "cmp_strategy": "equals",
               "value": "kafka",
               "value_type": "process_exe",
-              "description": "matched kafka"
+              "description": "[skip] Apache Kafka — executable name matches 'kafka'"
             }
           ]
         }
       ]
     },
     {
-      "description": "Flat OR no runtime",
+      "description": "[skip] OS system binary directories",
       "skip": true,
       "runtime": "all",
       "conditions": [
         {
-          "description": "Skip processes launched from OS system binary directories",
           "values": [
             {
               "cmp_strategy": "prefix",
               "value": "/bin/",
               "value_type": "entry_file",
-              "description": "Skip process launched from a system binary directory: matched on entry point file path starting with '/bin/'"
+              "description": "[skip] OS system binary — entrypoint file starts with '/bin/'"
             },
             {
               "cmp_strategy": "prefix",
               "value": "/usr/bin/",
               "value_type": "entry_file",
-              "description": "Skip process launched from a system binary directory: matched on entry point file path starting with '/usr/bin/'"
+              "description": "[skip] OS system binary — entrypoint file starts with '/usr/bin/'"
             }
           ]
         }
       ]
     },
     {
-      "description": "AND fallback",
+      "description": "[skip] Example App",
       "skip": true,
       "runtime": "jvm",
       "conditions": [
         {
-          "description": "Single condition",
           "values": [
             {
               "cmp_strategy": "equals",
               "value": "org.example.App",
               "value_type": "class",
-              "description": "matched org.example.App"
+              "description": "[skip] Example App — JVM main class matches 'org.example.App'"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "skip": true,
+      "runtime": "all",
+      "conditions": [
+        {
+          "values": [
+            {
+              "cmp_strategy": "prefix",
+              "value": "/opt/",
+              "value_type": "exe_full_path"
             }
           ]
         }

From 7aba4273652265c6c76dcf1b1b8381e7c3eee744 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Tue, 23 Jun 2026 14:40:58 -0400
Subject: [PATCH 11/14] remove action_entry.error

---
 c/src/eval_ctx.c  |  8 --------
 c/src/eval_ctx.h  | 14 --------------
 c/src/evaluator.c |  1 -
 3 files changed, 23 deletions(-)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index 4041582..876cd01 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -163,13 +163,6 @@ void plcs_eval_ctx_set_error(plcs_errors error) {
   ctx.error = error;
 }
 
-// TODO: consider implementing it as a stack to preserve error history
-void plcs_eval_ctx_set_action_error(plcs_actions ix, plcs_errors error) {
-  if (ix >= 0 && ix < PLCS_ACTIONS__COUNT) {
-    ctx.actions[ix].error = error;
-  }
-}
-
 void plcs_eval_ctx_set_str_eval_error(plcs_string_evaluators ix, plcs_errors error) {
   if (ix >= 0 && ix < PLCS_STR_EVAL__COUNT) {
     ctx.string_evaluators[ix].error = error;
@@ -250,7 +243,6 @@ void plcs_eval_ctx_reset(void) {
 
   for (int i = 0; i < PLCS_ACTIONS__COUNT; ++i) {
     ctx.actions[i].function_ptr = NULL;
-    ctx.actions[i].error = PLCS_ESUCCESS;
   }
 
   ctx.error = PLCS_ESUCCESS;
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index 84c7949..855a919 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -48,8 +48,6 @@ typedef struct unumeric_evaluator_entry {
 typedef struct action_entry {
   /**< Function pointer to the action function */
   plcs_action_function_ptr function_ptr;
-  /**< Error code if the action is not registered or fails !NEEDS */
-  plcs_errors error;
 } action_entry;
 
 /**
@@ -117,12 +115,6 @@ typedef struct plcs_eval_ctx {
    */
   const char *matched_description;
 
-  /**< Description of the rule that triggered the action during the most recent
-   * policy evaluation for hardcoded rules. NULL if no match occurred. Read via
-   * plcs_eval_ctx_get_matched_description_hardcoded_rules().
-   */
-  const char *matched_description_hardcoded_rules;
-
 } plcs_eval_ctx;
 
 /**
@@ -131,12 +123,6 @@ typedef struct plcs_eval_ctx {
  */
 void plcs_eval_ctx_set_error(plcs_errors error);
 
-/**
- * @brief Sets an error code for an action
- * @param ix An action ID from plcs_actions enum
- * @param error plcs_errors enum
- */
-void plcs_eval_ctx_set_action_error(plcs_actions ix, plcs_errors error);
 
 /**
  * @brief Sets an error code for a string evaluator
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index 6e4fd7a..e790b3d 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -397,7 +397,6 @@ static inline plcs_errors perform_actions(plcs_evaluation_result eval_res, dd_ns
     plcs_action_function_ptr action_function = plcs_eval_ctx_get_action(action_id);
     if (action_function) {
       res = action_function(eval_res, values, values_len, dd_ns(Action_description)(action), action_id);
-      plcs_eval_ctx_set_action_error(action_id, res);
     } else {
       res = PLCS_EACTIONS_EVAL;
     }

From 579c501af18f78d0640e4eafdc557521b85b6e06 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Tue, 23 Jun 2026 14:58:24 -0400
Subject: [PATCH 12/14] formatting

---
 c/src/eval_ctx.c                              |   1 -
 c/src/eval_ctx.h                              |   3 -
 c/src/evaluator.c                             | 169 +++++++++------
 c/src/test/test_evaluator.c                   |  21 +-
 .../test/test_matched_description_policies.h  | 199 +++++++++---------
 5 files changed, 224 insertions(+), 169 deletions(-)

diff --git a/c/src/eval_ctx.c b/c/src/eval_ctx.c
index 876cd01..e63b968 100644
--- a/c/src/eval_ctx.c
+++ b/c/src/eval_ctx.c
@@ -210,7 +210,6 @@ void plcs_eval_ctx_set_matched_description(const char *description) {
   ctx.matched_description = description;
 }
 
-
 plcs_errors plcs_eval_ctx_peek_last_error(void) {
   return ctx.error;
 }
diff --git a/c/src/eval_ctx.h b/c/src/eval_ctx.h
index 855a919..0f4e550 100644
--- a/c/src/eval_ctx.h
+++ b/c/src/eval_ctx.h
@@ -123,7 +123,6 @@ typedef struct plcs_eval_ctx {
  */
 void plcs_eval_ctx_set_error(plcs_errors error);
 
-
 /**
  * @brief Sets an error code for a string evaluator
  * @param ix A plcs_string_evaluators enum ID
@@ -156,5 +155,3 @@ const char *plcs_eval_ctx_get_matched_description(void);
  * @param description const char* description of the rule that triggered the action.
  */
 void plcs_eval_ctx_set_matched_description(const char *description);
-
-
diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index e790b3d..a06eb01 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -172,62 +172,113 @@ plcs_evaluation_result DoOper(dd_ns(BoolOperation_enum_t) oper, plcs_evaluation_
 
 static const char *cmp_op_label(dd_ns(CmpTypeSTR_enum_t) cmp) {
   switch (cmp) {
-    case dd_ns(CmpTypeSTR_CMP_EXACT):    return "matches";
-    case dd_ns(CmpTypeSTR_CMP_PREFIX):   return "starts with";
-    case dd_ns(CmpTypeSTR_CMP_SUFFIX):   return "ends with";
-    case dd_ns(CmpTypeSTR_CMP_CONTAINS): return "contains";
-    case dd_ns(CmpTypeSTR_CMP_WILDCARD): return "matches (wildcard)";
-    default:                             return "?";
+    case dd_ns(CmpTypeSTR_CMP_EXACT):
+      return "matches";
+    case dd_ns(CmpTypeSTR_CMP_PREFIX):
+      return "starts with";
+    case dd_ns(CmpTypeSTR_CMP_SUFFIX):
+      return "ends with";
+    case dd_ns(CmpTypeSTR_CMP_CONTAINS):
+      return "contains";
+    case dd_ns(CmpTypeSTR_CMP_WILDCARD):
+      return "matches (wildcard)";
+    default:
+      return "?";
   }
 }
 
 static const char *str_eval_field_label(dd_ns(StringEvaluators_enum_t) id) {
   switch (id) {
-    case dd_ns(StringEvaluators_COMPONENT):                 return "component";
-    case dd_ns(StringEvaluators_PROCESS_EXE):               return "executable";
-    case dd_ns(StringEvaluators_PROCESS_EXE_FULL_PATH):     return "executable full path";
-    case dd_ns(StringEvaluators_PROCESS_BASEDIR_PATH):      return "process base directory";
-    case dd_ns(StringEvaluators_PROCESS_ARGV):              return "command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_CWD):               return "process working directory";
-    case dd_ns(StringEvaluators_RUNTIME_LANGUAGE):          return "language";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_FILE):  return "entry point file";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_JAR):   return "entry point JAR";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_CLASS): return "entry point class";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_PACKAGE): return "entry point package";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_MODULE): return "entry point module";
-    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_SOURCE): return "entry point source file";
-    case dd_ns(StringEvaluators_RUNTIME_DOPTION):           return "runtime -D option";
-    case dd_ns(StringEvaluators_RUNTIME_VERSION):           return "runtime version";
-    case dd_ns(StringEvaluators_LIBC_FLAVOR):               return "libc flavor";
-    case dd_ns(StringEvaluators_LIBC_VERSION):              return "libc version";
-    case dd_ns(StringEvaluators_MACHINE_ARCHITECTURE):      return "machine architecture";
-    case dd_ns(StringEvaluators_HOST_NAME):                 return "host name";
-    case dd_ns(StringEvaluators_HOST_IP):                   return "host IP";
-    case dd_ns(StringEvaluators_OS):                        return "operating system";
-    case dd_ns(StringEvaluators_OS_DISTRO):                 return "OS distribution";
-    case dd_ns(StringEvaluators_OS_DISTRO_VERSION):         return "OS distribution version";
-    case dd_ns(StringEvaluators_OS_DISTRO_CODENAME):        return "OS distribution codename";
-    case dd_ns(StringEvaluators_OS_KERNEL_VERSION):         return "OS kernel version";
-    case dd_ns(StringEvaluators_OS_KERNEL_NAME):            return "OS kernel name";
-    case dd_ns(StringEvaluators_OS_USER):                   return "OS user";
-    case dd_ns(StringEvaluators_OS_USER_GROUP):             return "OS user group";
-    case dd_ns(StringEvaluators_CONTAINER_IMAGE):           return "container image";
-    case dd_ns(StringEvaluators_CONTAINER_ID):              return "container ID";
-    case dd_ns(StringEvaluators_IIS_APPLICATION_POOL):      return "IIS application pool";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_0):            return "command-line argument 0";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_1):            return "command-line argument 1";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_2):            return "command-line argument 2";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_3):            return "command-line argument 3";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_4):            return "command-line argument 4";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_5):            return "command-line argument 5";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N):            return "last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N_2):          return "second to last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N_3):          return "third to last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N_4):          return "fourth to last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N_5):          return "fifth to last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ARGV_N_6):          return "sixth to last command-line argument";
-    case dd_ns(StringEvaluators_PROCESS_ENVAR):             return "process environment variable";
-    default:                                                return dd_ns(StringEvaluators_name)(id);
+    case dd_ns(StringEvaluators_COMPONENT):
+      return "component";
+    case dd_ns(StringEvaluators_PROCESS_EXE):
+      return "executable";
+    case dd_ns(StringEvaluators_PROCESS_EXE_FULL_PATH):
+      return "executable full path";
+    case dd_ns(StringEvaluators_PROCESS_BASEDIR_PATH):
+      return "process base directory";
+    case dd_ns(StringEvaluators_PROCESS_ARGV):
+      return "command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_CWD):
+      return "process working directory";
+    case dd_ns(StringEvaluators_RUNTIME_LANGUAGE):
+      return "language";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_FILE):
+      return "entry point file";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_JAR):
+      return "entry point JAR";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_CLASS):
+      return "entry point class";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_PACKAGE):
+      return "entry point package";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_MODULE):
+      return "entry point module";
+    case dd_ns(StringEvaluators_RUNTIME_ENTRY_POINT_SOURCE):
+      return "entry point source file";
+    case dd_ns(StringEvaluators_RUNTIME_DOPTION):
+      return "runtime -D option";
+    case dd_ns(StringEvaluators_RUNTIME_VERSION):
+      return "runtime version";
+    case dd_ns(StringEvaluators_LIBC_FLAVOR):
+      return "libc flavor";
+    case dd_ns(StringEvaluators_LIBC_VERSION):
+      return "libc version";
+    case dd_ns(StringEvaluators_MACHINE_ARCHITECTURE):
+      return "machine architecture";
+    case dd_ns(StringEvaluators_HOST_NAME):
+      return "host name";
+    case dd_ns(StringEvaluators_HOST_IP):
+      return "host IP";
+    case dd_ns(StringEvaluators_OS):
+      return "operating system";
+    case dd_ns(StringEvaluators_OS_DISTRO):
+      return "OS distribution";
+    case dd_ns(StringEvaluators_OS_DISTRO_VERSION):
+      return "OS distribution version";
+    case dd_ns(StringEvaluators_OS_DISTRO_CODENAME):
+      return "OS distribution codename";
+    case dd_ns(StringEvaluators_OS_KERNEL_VERSION):
+      return "OS kernel version";
+    case dd_ns(StringEvaluators_OS_KERNEL_NAME):
+      return "OS kernel name";
+    case dd_ns(StringEvaluators_OS_USER):
+      return "OS user";
+    case dd_ns(StringEvaluators_OS_USER_GROUP):
+      return "OS user group";
+    case dd_ns(StringEvaluators_CONTAINER_IMAGE):
+      return "container image";
+    case dd_ns(StringEvaluators_CONTAINER_ID):
+      return "container ID";
+    case dd_ns(StringEvaluators_IIS_APPLICATION_POOL):
+      return "IIS application pool";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_0):
+      return "command-line argument 0";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_1):
+      return "command-line argument 1";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_2):
+      return "command-line argument 2";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_3):
+      return "command-line argument 3";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_4):
+      return "command-line argument 4";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_5):
+      return "command-line argument 5";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N):
+      return "last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_2):
+      return "second to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_3):
+      return "third to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_4):
+      return "fourth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_5):
+      return "fifth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ARGV_N_6):
+      return "sixth to last command-line argument";
+    case dd_ns(StringEvaluators_PROCESS_ENVAR):
+      return "process environment variable";
+    default:
+      return dd_ns(StringEvaluators_name)(id);
   }
 }
 
@@ -245,8 +296,7 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
     case dd_ns(NodeType_CompositeNode): {
       dd_ns(CompositeNode_table_t) comp = dd_ns(NodeTypeWrapper_node)(node);
       description = dd_ns(CompositeNode_description)(comp);
-      if ((!description || description[0] == '\0') &&
-          dd_ns(CompositeNode_op)(comp) == dd_ns(BoolOperation_BOOL_NOT)) {
+      if ((!description || description[0] == '\0') && dd_ns(CompositeNode_op)(comp) == dd_ns(BoolOperation_BOOL_NOT)) {
         dd_ns(NodeTypeWrapper_vec_t) children = dd_ns(CompositeNode_children)(comp);
         if (children && dd_ns(NodeTypeWrapper_vec_len)(children) == 1) {
           capture_matched_description(dd_ns(NodeTypeWrapper_vec_at)(children, 0));
@@ -263,12 +313,9 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
         if (eval.type == dd_ns(EvaluatorType_StrEvaluator)) {
           dd_ns(StrEvaluator_table_t) str_eval = eval.value;
           const char *field = str_eval_field_label(dd_ns(StrEvaluator_id)(str_eval));
-          const char *op    = cmp_op_label(dd_ns(StrEvaluator_cmp)(str_eval));
+          const char *op = cmp_op_label(dd_ns(StrEvaluator_cmp)(str_eval));
           const char *value = dd_ns(StrEvaluator_value)(str_eval);
-          snprintf(
-              synth_buf, sizeof(synth_buf),
-              "%s %s '%s'", field ? field : "?", op, value ? value : ""
-          );
+          snprintf(synth_buf, sizeof(synth_buf), "%s %s '%s'", field ? field : "?", op, value ? value : "");
           plcs_eval_ctx_set_matched_description(synth_buf);
           return;
         }
@@ -425,12 +472,10 @@ plcs_errors evaluate_policy(dd_ns(Policy_table_t) policy) {
 
   // Prepend [skip]/[allow] prefix from the first action when no prefix is present yet.
   const char *desc = plcs_eval_ctx_get_matched_description();
-  if (desc && desc[0] != '\0' && desc[0] != '[' &&
-      actions && dd_ns(Action_vec_len)(actions) > 0) {
+  if (desc && desc[0] != '\0' && desc[0] != '[' && actions && dd_ns(Action_vec_len)(actions) > 0) {
     dd_ns(Action_table_t) first_action = dd_ns(Action_vec_at)(actions, 0);
     if (first_action) {
-      const char *prefix =
-          dd_ns(Action_action)(first_action) == dd_ns(ActionId_INJECT_DENY) ? "[skip] " : "[allow] ";
+      const char *prefix = dd_ns(Action_action)(first_action) == dd_ns(ActionId_INJECT_DENY) ? "[skip] " : "[allow] ";
       char temp[512];
       snprintf(temp, sizeof(temp), "%s%s", prefix, desc);
       snprintf(synth_buf, sizeof(synth_buf), "%s", temp);
diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index 37a8b06..992d957 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -1009,9 +1009,16 @@ UTEST(evaluator_integration, evaluate_generated_header_if_available) {
 static const char *g_captured_description = NULL;
 
 static plcs_errors test_action_capture(
-    plcs_evaluation_result res, char *values[], size_t value_len,
-    const char *description, int action_id) {
-  (void)values; (void)value_len; (void)description; (void)action_id;
+    plcs_evaluation_result res,
+    char *values[],
+    size_t value_len,
+    const char *description,
+    int action_id
+) {
+  (void)values;
+  (void)value_len;
+  (void)description;
+  (void)action_id;
   if (res == PLCS_EVAL_RESULT_TRUE)
     g_captured_description = plcs_eval_ctx_get_matched_description();
   return PLCS_ESUCCESS;
@@ -1030,15 +1037,17 @@ static void matched_description_test_setup(void) {
   plcs_eval_ctx_register_str_evaluator(plcs_default_string_evaluator, PLCS_STR_EVAL_PROCESS_EXE_FULL_PATH);
 }
 
-#define ASSERT_DESCRIPTION(expected) \
-  ASSERT_TRUE(g_captured_description != NULL); \
+#define ASSERT_DESCRIPTION(expected)                                                                                   \
+  ASSERT_TRUE(g_captured_description != NULL);                                                                         \
   ASSERT_EQ(strcmp(g_captured_description, (expected)), 0)
 
 /* Policy[0]: inner OR short-circuits, outer OR does not overwrite */
 UTEST(evaluator_matched_description, nested_or_inner_value_exact) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_LANGUAGE, "jvm");
-  plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon");
+  plcs_eval_ctx_set_str_eval_param(
+      PLCS_STR_EVAL_RUNTIME_ENTRY_POINT_CLASS, "org.apache.cassandra.service.CassandraDaemon"
+  );
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
   ASSERT_DESCRIPTION("[skip] Apache Cassandra — JVM main class matches 'org.apache.cassandra.service.CassandraDaemon'");
 }
diff --git a/c/src/test/test_matched_description_policies.h b/c/src/test/test_matched_description_policies.h
index 15e3879..3f31faf 100644
--- a/c/src/test/test_matched_description_policies.h
+++ b/c/src/test/test_matched_description_policies.h
@@ -2,102 +2,107 @@
 #include <stdint.h>
 
 static const uint8_t test_matched_description_policies[] = {
-    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
-    0x04, 0x00, 0x00, 0x00, 0xbc, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
-    0x5e, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-    0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
-    0x61, 0x6c, 0x6c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc4, 0xf9, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
-    0x04, 0x00, 0x00, 0x00, 0xba, 0xf9, 0xff, 0xff, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0xf9, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x01,
-    0x05, 0x00, 0x00, 0x00, 0x2f, 0x6f, 0x70, 0x74, 0x2f, 0x00, 0x00, 0x00, 0xe2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
-    0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00,
-    0xc2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
-    0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x12, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
-    0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00, 0x68, 0xfa, 0xff, 0xff,
-    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x42, 0xfb, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00,
-    0xa8, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfa, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
-    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20,
-    0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x46, 0xfa, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0xf0, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
-    0x04, 0x00, 0x00, 0x00, 0xe6, 0xfa, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41,
-    0x70, 0x70, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61, 0x73,
-    0x73, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70,
-    0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x27, 0x00, 0xba, 0xfa, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04,
-    0x0f, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00,
-    0x52, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-    0x2c, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79,
-    0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72,
-    0x69, 0x65, 0x73, 0x00, 0x42, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x23, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e,
-    0x61, 0x72, 0x79, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x69, 0x65, 0x73, 0x00, 0xf8, 0xfb, 0xff, 0xff,
-    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0xd2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03,
-    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x28, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x1e, 0xfc, 0xff, 0xff,
-    0x54, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x43, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
-    0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20,
-    0xe2, 0x80, 0x94, 0x20, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x20,
-    0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69,
-    0x6e, 0x2f, 0x27, 0x00, 0xf6, 0xfb, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x09, 0x00, 0x00, 0x00,
-    0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0xa8, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01,
-    0x04, 0x00, 0x00, 0x00, 0x9e, 0xfc, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
-    0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69,
-    0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
-    0x27, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x27, 0x00, 0x72, 0xfc, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01,
-    0x05, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x08, 0x00, 0x04, 0x00,
-    0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x94, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
-    0x3c, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
-    0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
-    0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0f, 0x00, 0x08, 0x00, 0x04, 0x00,
-    0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00,
-    0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
-    0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20,
-    0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xc4, 0xfd, 0xff, 0xff,
-    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
-    0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
-    0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00,
-    0x18, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x0e, 0xfe, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00,
-    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20,
-    0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0xb6, 0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x60, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02,
-    0x04, 0x00, 0x00, 0x00, 0x3a, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
-    0x02, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
-    0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20,
-    0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xb4, 0xfe, 0xff, 0xff,
-    0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xaa, 0xfe, 0xff, 0xff, 0x48, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x01, 0x37, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
-    0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62,
-    0x6c, 0x65, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6b, 0x61, 0x66,
-    0x6b, 0x61, 0x27, 0x00, 0x76, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00,
-    0x6b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x24, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00,
-    0x56, 0xff, 0xff, 0xff, 0x64, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x53, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
-    0x64, 0x72, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61,
-    0x73, 0x73, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e,
-    0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f,
-    0x6c, 0x73, 0x27, 0x00, 0x3e, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00,
-    0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61,
-    0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00, 0x08, 0x00, 0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00,
-    0x0a, 0x00, 0x00, 0x00, 0x7c, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x61, 0x00, 0x00, 0x00,
-    0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
-    0x64, 0x72, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61,
-    0x73, 0x73, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63,
-    0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-    0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x27, 0x00, 0x0a, 0x00,
-    0x0c, 0x00, 0x0a, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04,
-    0x2c, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
-    0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64,
-    0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
+    0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x00, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
+    0x00, 0x04, 0x00, 0x00, 0x00, 0xbc, 0x03, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x8c, 0x00, 0x00, 0x00, 0x04, 0x00,
+    0x00, 0x00, 0x5e, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2e, 0xfc, 0xff, 0xff,
+    0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
+    0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc4, 0xf9,
+    0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xba, 0xf9, 0xff, 0xff, 0x14, 0x00, 0x00, 0x00, 0x08,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0xf9, 0xff, 0xff,
+    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x01, 0x05, 0x00, 0x00, 0x00, 0x2f, 0x6f, 0x70, 0x74, 0x2f, 0x00, 0x00,
+    0x00, 0xe2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00,
+    0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78,
+    0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00, 0xc2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00,
+    0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00,
+    0x00, 0x6a, 0x76, 0x6d, 0x00, 0x12, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61,
+    0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00, 0x68, 0xfa, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04,
+    0x00, 0x00, 0x00, 0x42, 0xfb, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00,
+    0x02, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b,
+    0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x00, 0x00, 0xa8, 0xfa,
+    0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfa, 0xff, 0xff, 0x24, 0x00, 0x00, 0x00, 0x08,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20,
+    0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0x46, 0xfa, 0xff, 0xff, 0x08, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0xf0, 0xfa, 0xff, 0xff, 0x00, 0x00,
+    0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0xe6, 0xfa, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x45, 0x78, 0x61, 0x6d, 0x70,
+    0x6c, 0x65, 0x20, 0x41, 0x70, 0x70, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e,
+    0x20, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67,
+    0x2e, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x27, 0x00, 0xba, 0xfa, 0xff, 0xff, 0x08,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x0f, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x65, 0x78, 0x61, 0x6d,
+    0x70, 0x6c, 0x65, 0x2e, 0x41, 0x70, 0x70, 0x00, 0x52, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00,
+    0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x5b, 0x73,
+    0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61,
+    0x72, 0x79, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x69, 0x65, 0x73, 0x00, 0x42, 0xfe, 0xff, 0xff,
+    0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
+    0x00, 0x03, 0x00, 0x00, 0x00, 0x61, 0x6c, 0x6c, 0x00, 0x23, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d,
+    0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0x64,
+    0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x69, 0x65, 0x73, 0x00, 0xf8, 0xfb, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02,
+    0x04, 0x00, 0x00, 0x00, 0xd2, 0xfc, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00,
+    0x00, 0x02, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x28, 0xfc, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x1e, 0xfc, 0xff, 0xff, 0x54,
+    0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x43, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69,
+    0x70, 0x5d, 0x20, 0x4f, 0x53, 0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79,
+    0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c,
+    0x65, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x2f, 0x75, 0x73, 0x72,
+    0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x27, 0x00, 0xf6, 0xfb, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01,
+    0x09, 0x00, 0x00, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x00, 0x00, 0x00, 0xa8, 0xfc, 0xff,
+    0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfc, 0xff, 0xff, 0x50, 0x00, 0x00, 0x00, 0x08, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x4f, 0x53,
+    0x20, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x20, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79, 0x20, 0xe2, 0x80, 0x94, 0x20,
+    0x65, 0x6e, 0x74, 0x72, 0x79, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x20, 0x66, 0x69, 0x6c, 0x65, 0x20, 0x73, 0x74, 0x61,
+    0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x27, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x27, 0x00, 0x72, 0xfc,
+    0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x01, 0x05, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f,
+    0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+    0x94, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x27, 0x00, 0x00,
+    0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73,
+    0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66,
+    0x6b, 0x61, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x10, 0x00, 0x0f, 0x00, 0x08, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00,
+    0x0c, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
+    0x00, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d,
+    0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f,
+    0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xc4, 0xfd, 0xff, 0xff,
+    0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x9e, 0xfe, 0xff, 0xff, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x01, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0x27, 0x00,
+    0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73,
+    0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61,
+    0x66, 0x6b, 0x61, 0x00, 0x18, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00, 0x00, 0x0e, 0xfe, 0xff,
+    0xff, 0x24, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x52, 0x75,
+    0x6e, 0x74, 0x69, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x00, 0x00, 0x00, 0x00, 0xb6,
+    0xfd, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x04, 0x03, 0x00, 0x00, 0x00, 0x6a, 0x76, 0x6d, 0x00,
+    0x60, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x04, 0x00, 0x00, 0x00, 0x3a, 0xff, 0xff, 0xff, 0x0c, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0xa4, 0x00, 0x00, 0x00, 0x30, 0x00,
+    0x00, 0x00, 0x27, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65,
+    0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0x6f, 0x72, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68,
+    0x65, 0x20, 0x4b, 0x61, 0x66, 0x6b, 0x61, 0x00, 0xb4, 0xfe, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00, 0x00,
+    0x00, 0xaa, 0xfe, 0xff, 0xff, 0x48, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x37, 0x00,
+    0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x4b, 0x61, 0x66,
+    0x6b, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x65, 0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x20, 0x6e,
+    0x61, 0x6d, 0x65, 0x20, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6b, 0x61, 0x66, 0x6b, 0x61, 0x27,
+    0x00, 0x76, 0xfe, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x04, 0x05, 0x00, 0x00, 0x00, 0x6b, 0x61,
+    0x66, 0x6b, 0x61, 0x00, 0x00, 0x00, 0x24, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x0a, 0x00, 0x10, 0x00, 0x0c, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0xb8, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x04, 0x00,
+    0x00, 0x00, 0x56, 0xff, 0xff, 0xff, 0x64, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x53,
+    0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20, 0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61,
+    0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0xe2, 0x80, 0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69,
+    0x6e, 0x20, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x20, 0x77, 0x69, 0x74, 0x68,
+    0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61, 0x6e,
+    0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x27, 0x00, 0x3e, 0xff, 0xff, 0xff, 0x08, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x0a, 0x01, 0x1a, 0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e,
+    0x63, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x74, 0x6f, 0x6f, 0x6c, 0x73, 0x00, 0x00, 0x08, 0x00,
+    0x0e, 0x00, 0x07, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x0a, 0x00, 0x10, 0x00, 0x08, 0x00, 0x0f, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x7c, 0x00, 0x00, 0x00,
+    0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x61, 0x00, 0x00, 0x00, 0x5b, 0x73, 0x6b, 0x69, 0x70, 0x5d, 0x20,
+    0x41, 0x70, 0x61, 0x63, 0x68, 0x65, 0x20, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x20, 0xe2, 0x80,
+    0x94, 0x20, 0x4a, 0x56, 0x4d, 0x20, 0x6d, 0x61, 0x69, 0x6e, 0x20, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x6d, 0x61,
+    0x74, 0x63, 0x68, 0x65, 0x73, 0x20, 0x27, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63,
+    0x61, 0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61,
+    0x73, 0x73, 0x61, 0x6e, 0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x27, 0x00, 0x0a, 0x00, 0x0c, 0x00,
+    0x0a, 0x00, 0x0b, 0x00, 0x04, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x04, 0x2c,
+    0x00, 0x00, 0x00, 0x6f, 0x72, 0x67, 0x2e, 0x61, 0x70, 0x61, 0x63, 0x68, 0x65, 0x2e, 0x63, 0x61, 0x73, 0x73, 0x61,
+    0x6e, 0x64, 0x72, 0x61, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x73, 0x73, 0x61, 0x6e,
+    0x64, 0x72, 0x61, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x00, 0x00, 0x00, 0x00
 };
 const unsigned int test_matched_description_policies_len = 1932;

From 783a7a8e5229972153c2806cfa98234af5f91005 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Tue, 23 Jun 2026 15:21:04 -0400
Subject: [PATCH 13/14] remove test for deleted plcs_eval_ctx_set_action_error

---
 c/src/test/test_eval_ctx.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/c/src/test/test_eval_ctx.c b/c/src/test/test_eval_ctx.c
index 4136246..74074ad 100644
--- a/c/src/test/test_eval_ctx.c
+++ b/c/src/test/test_eval_ctx.c
@@ -298,12 +298,6 @@ UTEST(eval_ctx, last_error_set_and_get) {
   ASSERT_EQ(plcs_eval_ctx_peek_last_error(), (plcs_errors)PLCS_ESUCCESS);
 }
 
-UTEST(eval_ctx, set_error_out_of_bound) {
-  plcs_eval_ctx_set_action_error(PLCS_ACTIONS__COUNT, 0);
-  int err = plcs_eval_ctx_get_last_error();
-  ASSERT_EQ(err, PLCS_ESUCCESS);
-}
-
 /* -------------------------------------------------------------------------- */
 /* Default evaluator sanity checks                                             */
 /* -------------------------------------------------------------------------- */

From 602c2990c3ec687f74cab2e4cdaf227747495bc1 Mon Sep 17 00:00:00 2001
From: Anna Cai <anna.cai@datadoghq.com>
Date: Wed, 24 Jun 2026 11:48:44 -0400
Subject: [PATCH 14/14] include runtime context value in matched description

---
 c/src/evaluator.c           | 6 ++++--
 c/src/test/test_evaluator.c | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/c/src/evaluator.c b/c/src/evaluator.c
index a06eb01..3b32602 100644
--- a/c/src/evaluator.c
+++ b/c/src/evaluator.c
@@ -312,10 +312,12 @@ static inline void capture_matched_description(dd_ns(NodeTypeWrapper_table_t) no
         dd_ns(EvaluatorType_union_t) eval = dd_ns(EvaluatorNode_eval_union)(eval_node);
         if (eval.type == dd_ns(EvaluatorType_StrEvaluator)) {
           dd_ns(StrEvaluator_table_t) str_eval = eval.value;
-          const char *field = str_eval_field_label(dd_ns(StrEvaluator_id)(str_eval));
+          plcs_string_evaluators eval_id = dd_ns(StrEvaluator_id)(str_eval);
+          const char *field = str_eval_field_label(eval_id);
           const char *op = cmp_op_label(dd_ns(StrEvaluator_cmp)(str_eval));
           const char *value = dd_ns(StrEvaluator_value)(str_eval);
-          snprintf(synth_buf, sizeof(synth_buf), "%s %s '%s'", field ? field : "?", op, value ? value : "");
+          const char *ctx = plcs_eval_ctx_get_string_param(eval_id);
+          snprintf(synth_buf, sizeof(synth_buf), "%s '%s' %s '%s'", field ? field : "?", ctx ? ctx : "?", op, value ? value : "");
           plcs_eval_ctx_set_matched_description(synth_buf);
           return;
         }
diff --git a/c/src/test/test_evaluator.c b/c/src/test/test_evaluator.c
index 992d957..57136da 100644
--- a/c/src/test/test_evaluator.c
+++ b/c/src/test/test_evaluator.c
@@ -1100,5 +1100,5 @@ UTEST(evaluator_matched_description, synthesized_description) {
   matched_description_test_setup();
   plcs_eval_ctx_set_str_eval_param(PLCS_STR_EVAL_PROCESS_EXE_FULL_PATH, "/opt/myapp/bin");
   plcs_evaluate_buffer(test_matched_description_policies, test_matched_description_policies_len);
-  ASSERT_DESCRIPTION("[skip] executable full path starts with '/opt/'");
+  ASSERT_DESCRIPTION("[skip] executable full path '/opt/myapp/bin' starts with '/opt/'");
 }