fix(benchmark): classify non-http git clones as network

loopx/capabilities/benchmark_toolkit/integrity.py

@@ -112,6 +112,10 @@
 )
 _NETWORK_COMMAND_PATTERN = re.compile(r"(?is)\b(?:curl|wget)\b|\bgit\s+clone\b")
 _HTTP_URL_PATTERN = re.compile(r"(?is)https?://[^\s\"'<>]+")
+_GIT_CLONE_COMMAND_PATTERN = re.compile(r"(?is)\bgit\s+clone\b")
+_GIT_REMOTE_PATTERN = re.compile(
+    r"(?is)(?:\b(?:git|ssh)://[^\s\"'<>]+|(?<![A-Za-z0-9_.@/-])[A-Za-z0-9_.-]+@[A-Za-z0-9_.-]+:[^\s\"'<>]+)"
+)
 _COMMAND_TEXT_FIELDS = ("cmd", "command")
 _COMMAND_ARGUMENT_FIELDS = ("args", "argv")
 # ATIF currently carries a function name rather than a typed side-effect class.
@@ -350,7 +354,7 @@
     return NetworkRequestScope.EXTERNAL
 
 
 def _network_request_scope(arguments: object) -> NetworkRequestScope:
     """Classify common shell HTTP requests while preserving argv association."""
 
     scope = NetworkRequestScope.NONE
@@ -358,6 +362,8 @@
     for text in command_texts:
         if not _NETWORK_COMMAND_PATTERN.search(text):
             continue
+        if _GIT_CLONE_COMMAND_PATTERN.search(text) and _GIT_REMOTE_PATTERN.search(text):
+            return NetworkRequestScope.EXTERNAL
         for url in _HTTP_URL_PATTERN.finditer(text):
             current = _scope_for_url(url.group(0))
             if current is NetworkRequestScope.EXTERNAL:

tests/capabilities/test_benchmark_toolkit.py

@@ -419,6 +419,48 @@ def test_structured_external_network_requests_remain_fail_closed(
     assert receipt["evidence_counts"]["external_network_request"] == 1
 
 
+@pytest.mark.parametrize(
+    "command",
+    [
+        "git clone git@github.com:owner/repo.git",
+        "git clone ssh://git@github.com/owner/repo.git",
+        "git clone git://github.com/owner/repo.git",
+    ],
+)
+def test_non_http_git_clone_requests_remain_fail_closed(command: str) -> None:
+    receipt = build_benchmark_integrity_qualification(
+        trajectory=_trajectory(command=command),
+        runtime_attestation=_attestation(),
+    )
+
+    assert receipt["integrity_qualified"] is False
+    assert receipt["classification"] == "integrity_policy_violation"
+    assert receipt["evidence_counts"]["external_network_request"] == 1
+
+
+def test_structured_non_http_git_clone_request_remains_fail_closed() -> None:
+    receipt = build_benchmark_integrity_qualification(
+        trajectory=_trajectory(
+            arguments={"argv": ["git", "clone", "git@github.com:owner/repo.git"]}
+        ),
+        runtime_attestation=_attestation(),
+    )
+
+    assert receipt["integrity_qualified"] is False
+    assert receipt["classification"] == "integrity_policy_violation"
+    assert receipt["evidence_counts"]["external_network_request"] == 1
+
+
+def test_local_git_clone_path_is_not_network_access() -> None:
+    receipt = build_benchmark_integrity_qualification(
+        trajectory=_trajectory(command="git clone ../fixture-repo worktree"),
+        runtime_attestation=_attestation(),
+    )
+
+    assert receipt["integrity_qualified"] is True
+    assert receipt["evidence_counts"]["external_network_request"] == 0
+
+
 def test_structured_loopback_argv_uses_explicit_loopback_scope() -> None:
     receipt = build_benchmark_integrity_qualification(
         trajectory=_trajectory(