anti de3634d739 feat(ttp): enable 6 xfail tests — evidence shape + tracing spans ...

- test_evidence_shape.py: replace broken (command, BehavioralLifter)
  pairing with correct (http_fingerprint, HttpFingerprintLifter) case;
  expand _LIFTER_CASES to 5-tuples with per-lifter payloads and rule
  factories; wire StubRuleStore + _index.install() per lifter; remove
  xfail marker — all 4 parametrized cases now pass

- factory.py: add _span() helper gated on _telemetry._ENABLED; wrap
  each per-lifter dispatch in _tag_one() that opens a
  ttp.lifter.{name} child span per call

- http_fingerprint_lifter.py: add missing name = "http_fingerprint"

- test_tracing.py: replace pytest.fail() stubs in
  test_lifter_child_spans_emitted and test_no_pii_canary_in_span_attributes
  with real test bodies; remove xfail markers

2026-05-10 08:51:07 -04:00

..

rule_precision

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

store

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

__init__.py

feat(ttp): E.1.3+E.1.4 Tagger ABC and composite factory contract

2026-05-01 06:20:10 -04:00

_stub_store.py

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

conftest.py

test(ttp): E.2.14a follow-up — force DECNET_DEVELOPER_TRACING=true, skip when Jaeger unreachable

2026-05-01 07:42:22 -04:00

test_attack_bundle_validation.py

feat(ttp): fail-closed validation that lifter+UKC IDs resolve in ATT&CK bundle

2026-05-09 05:58:06 -04:00

test_attack_catalog.py

feat(ttp): load MITRE ATT&CK from official STIX 2.1 bundle

2026-05-09 05:54:36 -04:00

test_attack_license.py

feat(ttp): fetch + verify MITRE ATT&CK LICENSE alongside the bundle

2026-05-09 06:17:46 -04:00

test_attack_url.py

feat(ttp): add mitre_url_for + groups_using_technique helpers

2026-05-09 06:32:04 -04:00

test_backfill.py

feat(ttp): E.4.a extract decnet/cli/ttp.py with worker run + backfill CLI

2026-05-02 01:35:17 -04:00

test_base.py

feat(ttp): implement evidence-shape validation and confidence range constraint

2026-05-10 07:56:52 -04:00

test_behavioral_lifter.py

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

test_canary_fingerprint_lifter.py

feat(ttp): E.3.11 CanaryFingerprintLifter (R0049-R0053)

2026-05-01 20:25:57 -04:00

test_confidence.py

feat(ttp): enable test_abuseipdb_score_30_dropped — impl was already done

2026-05-10 08:08:29 -04:00

test_credential_lifter.py

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

test_decoupling.py

test(ttp): E.2.7 decoupling lint — TTP code may not import decnet.intel.* providers or decnet.profiler.keystroke

2026-05-01 06:58:12 -04:00

test_email_lifter_disk_reach.py

feat(ttp): EmailLifter disk-reach for body-aware predicates (DEBT-047)

2026-05-02 20:05:54 -04:00

test_email_lifter.py

feat(ttp): E.3.12 EmailLifter (R0041-R0048)

2026-05-01 20:31:03 -04:00

test_emit_attaches_mitre_url.py

feat(ttp): promote mitre_url to first-class TTPTag column + propagate everywhere

2026-05-09 06:40:08 -04:00

test_evidence_shape.py

feat(ttp): enable 6 xfail tests — evidence shape + tracing spans

2026-05-10 08:51:07 -04:00

test_factory.py

feat(ttp): E.3.9 BehavioralLifter (R0031-R0040)

2026-05-01 20:17:59 -04:00

test_groups_for_technique.py

feat(web): GET /api/v1/ttp/techniques/{id}/groups — MITRE-tracked groups using a technique

2026-05-09 06:45:25 -04:00

test_http_fingerprint_lifter.py

feat(pr2): HTTP/2+HTTP/3 fingerprint extractors — JA4H, H2 SETTINGS, JA4-QUIC

2026-05-10 00:47:19 -04:00

test_idempotency.py

test(ttp): E.2.2 idempotency — determinism, golden value, replay-safety signature lock

2026-05-01 06:45:49 -04:00

test_identity_lifter.py

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

test_intel_lifter.py

fix(ttp): correct intel_lifter mappings + repoint ThreatFox to threat_type

2026-05-02 18:08:48 -04:00

test_intel_mappings.py

feat(ttp): extract intel_lifter provider mappings to YAML data + ATT&CK external_reference enrichment

2026-05-09 06:18:25 -04:00

test_lifter_absence.py

feat(web): drop SessionProfile, wire observations into AttackerDetail (DEBT-050 / DEBT-036 closure)

2026-05-03 07:33:37 -04:00

test_lifters.py

feat(ttp): E.3.13 IdentityLifter + CredentialLifter (R0001-R0006)

2026-05-01 20:52:56 -04:00

test_multi_mapping.py

feat(ttp): E.3.7 RuleEngine — evaluate + atomic-swap watch_store

2026-05-01 08:49:15 -04:00

test_rule_engine_tagger.py

feat(ttp): split bash CMD evidence into structured uid/user/src/pwd/cmd rows

2026-05-02 03:20:53 -04:00

test_rule_engine.py

fix(ttp): /api/v1/ttp/rules returns the live rule catalogue

2026-05-02 01:54:06 -04:00

test_rule_index.py

refactor(ttp): extract RuleIndex from RuleEngine

2026-05-01 20:09:18 -04:00

test_schema.py

feat(ttp): implement evidence-shape validation and confidence range constraint

2026-05-10 07:56:52 -04:00

test_stix_custom.py

feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

2026-05-09 08:52:19 -04:00

test_stix_export_threat_actor_extensions.py

feat(stix_export): wire fingerprint bounties through all endpoints + tests

2026-05-09 09:14:48 -04:00

test_tracing.py

feat(ttp): enable 6 xfail tests — evidence shape + tracing spans

2026-05-10 08:51:07 -04:00

test_worker_bus.py

test(ttp): enable test_dropped_intel_enriched_still_produces_intel_tags

2026-05-10 08:30:44 -04:00

test_worker_command_fanout.py

feat(ttp): E.3.18b worker fans session-ended payloads into per-command events

2026-05-02 01:27:37 -04:00

test_worker_resolve_attacker.py

fix(ttp): resolve attacker_uuid from attacker_ip on bus-event consume

2026-05-02 02:44:30 -04:00

test_worker_watch_loop.py

fix(ttp): E.3.18a worker hydrates per-lifter rule indexes via watch_store

2026-05-02 01:25:15 -04:00

test_worker.py

feat(ttp): E.3.14 worker bootstrap (insert + ttp.tagged publish)

2026-05-01 20:57:57 -04:00