diff options
Diffstat (limited to 'AGENTS.md')
| -rw-r--r-- | AGENTS.md | 19 |
1 files changed, 17 insertions, 2 deletions
@@ -165,10 +165,11 @@ abusectl/ case.py case directory: create, manifest read/write, atomic contacts.py IOCs -> abuse contacts network, read-only rdap.py bootstrap, query, jCard network, read-only + report.py IOCs + contacts -> bodies, destinations[] pure ``` -Planned, each needing its own spec first: `report` (X-ARF), `submit` (MISP then -vendors), `retry` (cron). See the design document. +Planned, each needing its own spec first: `submit` (MISP then vendors), +`retry` (cron). See the design document. **`redact.py` is separate from `parse.py` deliberately.** It is the safety property, and a module of its own gets tests that name it rather than tests @@ -178,6 +179,12 @@ that reach it incidentally. That is what keeps it pure and testable with no files on disk. `cli.py` reads the config and passes it in. +**`report.DESTINATIONS` is transcribed from vendor documentation**, read +2026-09-10, the same rule as `init.PROVIDERS`: do not edit it from memory. A +wrong `accepts` means a row promising a submission the endpoint will refuse, +or a missing row for something the vendor would have taken. VirusTotal is +deliberately absent; backlog item 6 records the findings. + ## The case directory ``` @@ -228,6 +235,14 @@ path shows what is configured and asks, and either route backs the old file up first. **Sections `build()` does not produce are carried across verbatim**, so an init that only sets the relays cannot discard a `[misp]` key set earlier. +**A reporting destination is configured only when its section carries every +key it needs.** `[abusedb]` and `[urlhaus]` need `api_key`; `[misp]` needs +`url` AND `api_key`. Exactly one half of the MISP pair is +configured-and-broken rather than skipped, and `config.load()` reports it in +`incomplete` rather than raising: every subcommand loads this file, and +`parse` must not be refused over a section it never reads. `report` refuses +it, because that is the command that acts on it. + ## The provider table `init.PROVIDERS` holds each provider's published sending ranges, transcribed |