Add host correlation and assurance coverage

tests/test_rule_compat.py

@@ -95,6 +95,35 @@ class TestRuleEventCompatibility(unittest.TestCase):
         }
         self.assertIn(100068, self._sids(event))
 
+    def test_host_event_accepts_file_write_shape(self):
+        self.assertIn(100069, self._sids({
+            "event": "file_write",
+            "pid": 4242,
+            "ppid": 1,
+            "uid": 1000,
+            "comm": "python3",
+            "path": "/etc/systemd/system/evil.service",
+        }))
+
+    def test_host_event_accepts_chmod_and_setuid_shapes(self):
+        self.assertIn(100070, self._sids({
+            "event": "chmod",
+            "pid": 4242,
+            "ppid": 1,
+            "uid": 0,
+            "comm": "chmod",
+            "path": "/etc/cron.d/evil",
+            "mode": "0o777",
+        }))
+        self.assertIn(100071, self._sids({
+            "event": "setuid",
+            "pid": 4242,
+            "ppid": 1,
+            "uid": 1000,
+            "comm": "python3",
+            "target_uid": "0",
+        }))
+
     def test_unknown_event_shape_still_errors(self):
         with self.assertRaisesRegex(
             ValueError, "event JSON must be an exec, syscall, or host event"