lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
964 commits 2 branches 0 tags 15 MiB
Commit graph

5 commits

Author SHA1 Message Date
lorentz
9f12cd610a test(260721-n49): cover tenant-scoped vs global-fallback getBlastRadius branches 
- Add mimecast_tenants routing branch to stageQueries and company_id to
  report fixtures
- New test: enabled mimecast_tenants row -> getBlastRadius called with
  { client, cacheScope: companyId } and the tenant SQL is issued
- New parameterized test: null companyId and companyId-with-no-enabled-row
  -> getBlastRadius called with no second argument (global fallback)
 2026-07-21 16:45:44 -04:00
lorentz
204276c88a feat(quick-260717-a19): add 3 confirmed KnowBe4 domains to sim allowlist 
- Extend knowbe4 vendor entry with customer-portal.info,
  cloud-service-care.com, bankonlinesupport.com (confirmed via shared
  URL fingerprint across Seubert tickets 699419/699421/699422/699433/
  699435/699456 on 2026-07-16/17)
- domainMatchesAllowlist and isKnownSimulationSender untouched
- Add tests for exact match, subdomain match, and suffix-spoof rejection
 2026-07-17 07:19:18 -04:00
lorentz
14ed8ca248 feat(23-01): add USER_AWARENESS verdict + acknowledge_user action mapping 
- Add USER_AWARENESS to the Verdict union in campaign-classifier.ts
- mapVerdictToActions('USER_AWARENESS') returns ['acknowledge_user']; not added to DESTRUCTIVE_ACTIONS so requires_approval computes false
- classifyCampaign's simulation branch now assigns verdict = 'USER_AWARENESS' directly instead of falling through to evaluateSpamVsUnwanted
- deriveDefaultParams('acknowledge_user') returns {} (no operator-editable params)
- Widen TriageNoteEvidence.verdict to admit 'USER_AWARENESS' (pure type widen, no formatting change)
- Tests: classifier simulation fixtures now assert USER_AWARENESS/acknowledge_user/requiresApproval=false; new mapVerdictToActions/computeRequiresApproval/deriveDefaultParams cases
 2026-07-16 19:36:53 -04:00
lorentz
f6c954aa23 test(19-01): add classifyCampaign orchestrator tests (RED) 
- Mock ./postgres-client (query-only) and ./mimecast-blast-radius
  (getBlastRadius), routing staged rows by SQL substring per call
- Named tests for CLASSIFY-01 (returns exactly one verdict), D-02
  (append-only INSERT, no ON CONFLICT), D-06 simulation allowlist
  (KnowBe4 From-match + BSN Return-Path-match), positive-path D-03 THREAT,
  D-03 known-bad-indicator OR-branch (auth pass, shared indicator across 2
  messages), D-04 SPAM/UNWANTED split, and CLASSIFY-06 evidence bounding
 2026-07-16 08:20:49 -04:00
lorentz
f4e6baf505 test(19-01): add failing tests + synthetic fixtures for classifier pure rule functions 
- campaign-classifier.test.ts: describe blocks for domainMatchesAllowlist,
  isKnownSimulationSender, effectiveAuthResults, hasHardAuthFail,
  computeConfidence, mapVerdictToActions, computeRequiresApproval
- campaign-classifier.fixtures.ts: synthetic KnowBe4/BSN simulation fixtures
  plus non-simulation threat/clean-spam/suspicious-unwanted fixtures
- Covers CLASSIFY-01/02/03/04/06 pure-function behavior (T-19-01, Pitfall 1/3)
 2026-07-16 08:14:51 -04:00