add value-shape field classification and auto-apply

Field roles are now inferred from observed values instead of names,
with src/dst disambiguation, value-pattern detector hints, an Ollama
advisor scoped to ambiguous fields only, confidence-gated auto-apply
with manual-field protection, and drift flagging for review
This commit is contained in:
larssand
2026-09-07 21:58:25 +02:00
parent 7b94512abc
commit e35445da4f
22 changed files with 1133 additions and 93 deletions

View File

@@ -62,6 +62,26 @@ class ConfigTests(unittest.TestCase):
public = store.update({"graylog_tls_verify": False})
self.assertFalse(public["graylog_tls_verify"])
def test_profile_advisor_interval_seconds_is_numeric_and_bounded(self):
with tempfile.TemporaryDirectory() as directory:
store = ConfigStore(str(Path(directory) / "config.json"))
public = store.update({"profile_advisor_interval_seconds": "10"})
self.assertEqual(public["profile_advisor_interval_seconds"], 60)
public = store.update({"profile_advisor_interval_seconds": "600"})
self.assertEqual(public["profile_advisor_interval_seconds"], 600)
def test_field_confidence_threshold_is_numeric_and_clamped(self):
with tempfile.TemporaryDirectory() as directory:
store = ConfigStore(str(Path(directory) / "config.json"))
public = store.update({"field_confidence_threshold": "-5"})
self.assertEqual(public["field_confidence_threshold"], 0)
public = store.update({"field_confidence_threshold": "500"})
self.assertEqual(public["field_confidence_threshold"], 100)
public = store.update({"field_confidence_threshold": "70"})
self.assertEqual(public["field_confidence_threshold"], 70)
public = store.update({"field_confidence_threshold": "not-a-number"})
self.assertEqual(public["field_confidence_threshold"], 70)
def test_empty_stream_update_does_not_clear_existing_streams(self):
with tempfile.TemporaryDirectory() as directory:
store = ConfigStore(str(Path(directory) / "config.json"))