rule CodersSecret_Toy_Northstar_Release_Marker
{
  meta:
    description = "Classify two inert course fixtures that contain both documented toy markers"
    author = "CodersSecret course project"
    owner = "course-detection-review"
    status = "test"
    confidence = "high-for-this-toy-corpus-only"
    scope = "yara course fixtures in this directory"
    safety = "Literal toy markers only; no malware bytes"
    created = "2026-08-25"
    review_after = "2027-02-25"

  strings:
    $course_header = "CODERSSECRET TOY DETECTION FIXTURE" ascii
    $toy_marker = "TOY_MARKER_ALPHA" ascii
    $review_marker = "NORTHSTAR_RELEASE_REVIEW" ascii

  condition:
    filesize < 8KB and $course_header at 0 and all of ($toy_marker, $review_marker)
}