Repository navigation
Phase 1.4a: Attack-path chaining -- findings that are jointly critical #238
Description
Proposal 4, first half, in the next-phase document. Led by Shubham.
Recognise when two or more findings, each medium on its own, combine into something jointly critical -- and report the chain as one connected story rather than two unrelated cards.
The precondition the document now states honestly
Measured against a real finding:
structured 'rule' / 'flow' / 'policy' fields: False / False / False
detail: 'Expected DENY but got PERMIT, decided by: permit ip any any'
Only device is structured. Rule and flow are inside one free-text string, so chaining needs either careful prose parsing or a small agreed extension to the finding format -- which is a needs: all four decision, the way the format itself originally was.
Acceptance criteria
- A chain of two findings is reported as one connected item
- The individual findings are still reported -- a chain never replaces its parts
- Any finding-format change is raised and ratified separately before it is used
- A single finding never becomes a "chain of one"
- Mutation-tested
Split from
Proposal 4's compliance/CVE half is #220 and Phase 1.4b, so this is one piece rather than three.
Activity
A-3: tick my own row, and record that the signature is dated 31 August
shubhamkataria2005 commentedon Oct 18, 2026
Checklist for the first
subjectproducer, from @ARSH871-bot's review of #390. None of these may be skipped when a check starts populatingsubject:ai/explain.py:671sends the whole finding to the model,subjectincluded, but_names_an_invented_fact(:754-775) only checks summary, device, detail and source. A model that repeats asubjectaddress gets rejected as inventing it, so the explanation falls back to plain text. That's the safe direction, but it's a silent loss of explanations. Ankeet's layer — needs his call._F1_FIELDS(web/main.py:1771,:1792), andtests/test_history_api.py:149pins that. Sosubjectwill be silently dropped from history, and a chain formed from a live scan could not form from a saved one.make_findingacceptssubjectonnoneanderrorfindings. A chain must never run through a "could not check" card. Either refusesubjectthere or have the chaining skip non-foundfindings — and test whichever it is.