Unify live and PCAP Sampled Values observation pipeline#38
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0f0ad5ff7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| public sealed class SvSubscriberViewModel : ObservableObject, IDisposable | ||
| { | ||
| private readonly ConcurrentDictionary<string, SvStreamRuntime> _runtimeStreams = new(StringComparer.OrdinalIgnoreCase); | ||
| private readonly ConcurrentDictionary<string, SvStreamRuntime> _runtimeStreams = new(StringComparer.Ordinal); |
There was a problem hiding this comment.
Use ordinal row keys for the new stream identity
When the runtime map starts distinguishing stream keys with StringComparer.Ordinal, two SV streams whose svID or dataset reference differs only by case are now separate runtimes, but RefreshUiSnapshots still stores rows and stale-key sets with OrdinalIgnoreCase. In that scenario one row is reused and overwritten for the other stream, so the Subscriber UI hides one of the distinct observed streams; use the same ordinal comparer for _streamRows and the snapshot key set.
Useful? React with 👍 / 👎.
| var signature = profile?.Entries.Select(ToSignature).ToArray() | ||
| ?? Array.Empty<SvDatasetElementSignature>(); |
There was a problem hiding this comment.
Validate SCL identity before publishing derived facts
When the Subscriber's FindProfile returns its APPID-only fallback for a frame whose dataset reference does not match that SCL stream, this code still converts the profile entries into the observation's DataSetSignature and the state is marked SCL-bound. Since the existing SCL validation does not check DataSetReference, an unexpected dataset can be reported with SCL-derived facts instead of unknown/conflicting facts; require the wire svID and dataset reference to match before setting the signature/bound state.
Useful? React with 👍 / 👎.
Purpose
Complete P3B by routing both live Npcap capture and PCAP replay through one bounded, per-stream observation pipeline before adding profile UI or report presentation.
Completed changes
Shared observation pipeline
SvStreamObservationManagertoARSVIN.Engine.svID, and dataset reference.confRevfrom identity so revision changes remain visible as unstable facts instead of creating artificial streams.LiveCapture,PcapReplay, or both.svID, dataset,confRev, or payload length.Subscriber integration
NpcapProcessBusFrameSourcetraffic andPcapFrames.Readreplay through the same manager.SCL and evidence behavior
SclDerivedprovenance.Tests and coverage
confRevchanges, dataset separation, SCL signatures, invalid frames, and manager reset.Validation completed
Validated private artifact:
ARSVIN-0.0.0-pr.121-windows-x64, digestsha256:73e43809711378b4fcbcad78f0168518d4fd65fe1b6cbe627b965f9639af76f3.No major WPF redesign and no public release are included.