anti b819dfefa3 feat(ttp): E.3.8 R0054-R0058 intel cohort + mark step done ...

5 YAMLs for the intel-verdict cohort per Appendix B / A.10:
AbuseIPDB category mapping, GreyNoise classification, Feodo
Tracker hit, ThreatFox IOC type, aggregate-malicious bump-only.
IntelLifter (E.3.10) consumes by rule_id and tolerates absence
silently (null provider column → no tag).

R0058 is the meta bump-only rule — emits a single confidence=0.0
sentinel so it validates and surfaces in the catalogue, but the
repository's sub-0.3 drop ensures no fresh tag persists if the
fanout fires accidentally. test_intel_rules.py pins that
zero-confidence invariant.

Marks E.3.8 done in development/TTP_TAGGING.md with the cohort-
split summary.

2026-05-01 09:22:48 -04:00

..

rule_precision

feat(ttp): E.3.8 R0054-R0058 intel cohort + mark step done

2026-05-01 09:22:48 -04:00

store

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

__init__.py

feat(ttp): E.1.3+E.1.4 Tagger ABC and composite factory contract

2026-05-01 06:20:10 -04:00

conftest.py

test(ttp): E.2.14a follow-up — force DECNET_DEVELOPER_TRACING=true, skip when Jaeger unreachable

2026-05-01 07:42:22 -04:00

test_base.py

test(ttp): E.2.4 Tagger ABC conformance — hypothesis fuzz over swallowed Exception types

2026-05-01 06:54:29 -04:00

test_confidence.py

feat(ttp): E.3.3 repository — insert_tags + listing rollups (dual backend)

2026-05-01 08:04:46 -04:00

test_decoupling.py

test(ttp): E.2.7 decoupling lint — TTP code may not import decnet.intel.* providers or decnet.profiler.keystroke

2026-05-01 06:58:12 -04:00

test_evidence_shape.py

test(ttp): E.2.1b evidence shape — TypedDict keys, PII §6 type-level assertion

2026-05-01 06:45:35 -04:00

test_factory.py

feat(ttp): E.1.3+E.1.4 Tagger ABC and composite factory contract

2026-05-01 06:20:10 -04:00

test_idempotency.py

test(ttp): E.2.2 idempotency — determinism, golden value, replay-safety signature lock

2026-05-01 06:45:49 -04:00

test_lifter_absence.py

test(ttp): E.2.6 lifter tolerates absence — six lifters return [] on empty joins, no ERROR logs

2026-05-01 06:57:29 -04:00

test_lifters.py

feat(ttp): E.1.6 per-lifter contracts — six TolerantTagger subclasses

2026-05-01 06:31:31 -04:00

test_multi_mapping.py

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

test_rule_engine.py

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

test_schema.py

test(ttp): E.2.1 schema invariant tests — CHECK, ValueError guard, UUIDv5, JSON round-trip

2026-05-01 06:44:57 -04:00

test_tracing.py

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

test_worker_bus.py

test(ttp): E.2.12 worker bus integration — _TOPICS equality, loop-prevention, delivery asymmetry

2026-05-01 07:37:58 -04:00

test_worker.py

feat(ttp): E.1.7 worker contract — run_ttp_worker_loop, _TOPICS, registry entry

2026-05-01 06:33:34 -04:00