diff --git a/README.md b/README.md index 0ef307c..29d26fd 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Latest milestone: [v0.6.0 — fourth demo and config-change investigation](https | Demo | Input | Deterministic core | LLM role | Main artifacts | Guardrails / non-goals | | --- | --- | --- | --- | --- | --- | -| [telemetry-window-demo](#telemetry-window-demo) | JSONL / CSV events | Windows
Features
Alert thresholds | None | `features.csv`
`alerts.csv`
`summary.json`
3 PNG plots | MVP only
No realtime
No case management | +| [telemetry-window-demo](#telemetry-window-demo) | JSONL / CSV events | Windows
Features
Alert thresholds | None | `features.csv`
`alerts.csv`
`summary.json`
3 PNG plots | Local demo only
No realtime
No case management | | [ai-assisted-detection-demo](demos/ai-assisted-detection-demo/README.md) | JSONL auth / web / process | Normalize
Rules
Grouping
ATT&CK mapping | JSON-only case drafting | `rule_hits.json`
`case_bundles.json`
`case_summaries.json`
`case_report.md`
`audit_traces.jsonl` | Human verification required
No autonomous response
No final verdict | | [rule-evaluation-and-dedup-demo](demos/rule-evaluation-and-dedup-demo/README.md) | JSON raw rule hits | Scope resolution
Cooldown grouping
Suppression reasoning | None | `rule_hits_before_dedup.json`
`rule_hits_after_dedup.json`
`dedup_explanations.json`
`dedup_report.md` | No realtime
No dashboard
No AI stage | | [config-change-investigation-demo](demos/config-change-investigation-demo/README.md) | JSONL config changes
Policy denials
Follow-on events | Normalize
Risky-change rules
Bounded correlation | None | `change_events_normalized.json`
`investigation_hits.json`
`investigation_summary.json`
`investigation_report.md` | No realtime
No dashboard
No AI stage | @@ -161,7 +161,7 @@ Cooldown behavior: ## Scope -This repository is a portfolio prototype, not a production monitoring system. +This repository is a local, reviewer-oriented detection workflow lab, not a production monitoring system. ## Limitations diff --git a/docs/reviewer-brief.md b/docs/reviewer-brief.md index fc7c97e..34b212a 100644 --- a/docs/reviewer-brief.md +++ b/docs/reviewer-brief.md @@ -67,7 +67,7 @@ The other demos emit reviewer-facing artifacts such as `dedup_report.md`, `inves - no alert routing, dashboarding, or case management - sample-data driven, not connected to live systems - no streaming state management -- intentionally small-scope demos rather than a unified monitoring platform +- intentionally small-scope detection workflow demos rather than a unified monitoring platform ## Next milestone diff --git a/tests/test_reviewer_docs.py b/tests/test_reviewer_docs.py index 1d2db25..8a6ae4c 100644 --- a/tests/test_reviewer_docs.py +++ b/tests/test_reviewer_docs.py @@ -83,6 +83,7 @@ def _read_pyproject() -> dict[str, object]: def test_reviewer_path_keeps_detection_lab_positioning() -> None: reviewer_path = _read_repo_file("docs/reviewer-path.md") + reviewer_brief = _read_repo_file("docs/reviewer-brief.md") normalized = reviewer_path.lower() assert "controlled detection workflow portfolio" in reviewer_path @@ -90,6 +91,7 @@ def test_reviewer_path_keeps_detection_lab_positioning() -> None: assert "not a dashboard" in normalized assert "not an unfinished monitoring platform" in normalized assert "local and file-based" in normalized + assert "small-scope detection workflow demos" in reviewer_brief def test_reviewer_path_matrix_references_committed_artifacts() -> None: @@ -104,12 +106,16 @@ def test_reviewer_path_matrix_references_committed_artifacts() -> None: def test_readme_links_reviewer_path_and_uses_lab_framing() -> None: readme = _read_repo_file("README.md") + normalized = readme.lower() assert "A local, file-based detection workflow lab" in readme + assert "local, reviewer-oriented detection workflow lab" in readme assert "not a SIEM, dashboard, or monitoring platform" in readme assert "[`docs/reviewer-pack.md`](docs/reviewer-pack.md)" in readme assert "[`docs/reviewer-path.md`](docs/reviewer-path.md)" in readme assert "[`docs/architecture.md`](docs/architecture.md)" in readme + assert "portfolio prototype" not in normalized + assert "mvp only" not in normalized def test_package_metadata_uses_detection_lab_framing() -> None: