feat: per-technique validation-transferability property (roadmap #5) - #92
Merged
Conversation
Coverage honesty at catalog granularity: does a green result exercise the SHIPPED production rule, or only its parser? - Technique gains transferability (transfers | parser-only) and transferability_note. A model validator requires a note when parser-only: a parser-only claim with no reason tells an engineer nothing. Positive control: neutered the validator, the reject test went red, restored it green. - REP-011 (synthetic srccountry tag vs live GeoIP/ASN + IdP identity), REP-016 (DGA lexical/NXDOMAIN features transfer, but names sit under the reserved .invalid TLD), and REP-020 (org-wide first-contact novelty transfers, but the cited PREDATOR registration-age scoring needs WHOIS the reserved TLDs cannot carry) are labelled parser-only with specific reasons. The rest default to transfers, subject to the overall delivery-unverified gate. - REP-024 transfers but discloses the integer-second eventtime ceiling (the honest half of the rejected sub-second-eventtime proposal folds in here). - Surfaced where a CLI-first engineer looks: a Transfers column in 'replicant list' plus a parser-only notes footer, and in the web catalog JSON. 1067 tests, black/ruff/mypy clean.
…web card From /code-review on PR #92, verified before fixing: 1. REP-024's disclosed-limit note (the eventtime ceiling) was surfaced on no CLI surface: the footer only printed parser-only entries, though the field docstring and test treat a disclosed-limit-on-a-transferring-technique as a supported case. 'replicant list' now collects any technique with a note and labels each (parser-only) or (disclosed limit). Positive control: gated the footer on parser-only again, the CLI guard went red, restored it green. 2. The web TechniqueDetail card rendered none of the new fields though the API returned them (the roadmap names that card as the transferability surface). Added transferability/transferability_note to the api.ts Technique interface and a note block to the card; three frontend tests cover parser-only, disclosed-limit, and clean-transfer (renders nothing). 3. The 'Transfers' column mixed answer types (yes / parser-only); now symmetric yes / no, with the category detail in the footer. Also fixed the Rich-markup trap: [disclosed limit] parsed as a style tag and vanished, so the label is parenthesised. 1067 python + 175 frontend tests; black/ruff/mypy/tsc clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Roadmap 2026-09 item 5 (the last Now-section item), championed by all four domain experts. Coverage honesty at catalog granularity: it tells an engineer before they spend a validation cycle whether a technique's green result means the shipped rule works, or just its parser.
What changed
Techniquegainstransferability(transfers|parser-only) andtransferability_note. A model validator requires a note whenparser-only— a parser-only claim with no reason is useless. Positive control: neutered the validator, the reject test went red, restored it green.FTNTFGTsrccountryis a synthetic tag on a documentation IP..invalidTLD, so TLD/reputation/registration stages are not exercised.eventtimeceiling (the honest half of the rejected sub-second-eventtime proposal folds in here as a per-technique limit).transfers, still subject to the overall delivery-unverified gate.Transferscolumn inreplicant listplus a parser-only notes footer, and in the web catalog JSON. The richer per-run note will ride the validation card (docs: bring README up to date with the 24-technique catalog #7).1067 tests; black/ruff/mypy clean. Decision record:
docs/roadmap-2026-09.md.