From fa9d51612259c484448815162bba7a199bca60c7 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 17:01:27 +0200 Subject: docs: record the destination table and the configured rule AGENTS.md's architecture block still listed report as planned and had no report.py line at all, though it shipped over the previous eight tasks. Add the line, note the new destinations[] output, and record that DESTINATIONS is transcribed from vendor docs under the same rule as init.PROVIDERS. Also record in the Config section that a destination counts as configured only when its section carries every key DESTINATION_KEYS names, and that report is what refuses a half-filled one, not config.load(). README.md needed no change: it has no config.toml example to extend and its report description is a one-line command table entry with no per-destination detail to fall behind. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0176FYdVfpzUq8S9jecqQqL6 --- AGENTS.md | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index e627e50..6b37b99 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -165,10 +165,11 @@ abusectl/ case.py case directory: create, manifest read/write, atomic contacts.py IOCs -> abuse contacts network, read-only rdap.py bootstrap, query, jCard network, read-only + report.py IOCs + contacts -> bodies, destinations[] pure ``` -Planned, each needing its own spec first: `report` (X-ARF), `submit` (MISP then -vendors), `retry` (cron). See the design document. +Planned, each needing its own spec first: `submit` (MISP then vendors), +`retry` (cron). See the design document. **`redact.py` is separate from `parse.py` deliberately.** It is the safety property, and a module of its own gets tests that name it rather than tests @@ -178,6 +179,12 @@ that reach it incidentally. That is what keeps it pure and testable with no files on disk. `cli.py` reads the config and passes it in. +**`report.DESTINATIONS` is transcribed from vendor documentation**, read +2026-09-10, the same rule as `init.PROVIDERS`: do not edit it from memory. A +wrong `accepts` means a row promising a submission the endpoint will refuse, +or a missing row for something the vendor would have taken. VirusTotal is +deliberately absent; backlog item 6 records the findings. + ## The case directory ``` @@ -228,6 +235,14 @@ path shows what is configured and asks, and either route backs the old file up first. **Sections `build()` does not produce are carried across verbatim**, so an init that only sets the relays cannot discard a `[misp]` key set earlier. +**A reporting destination is configured only when its section carries every +key it needs.** `[abusedb]` and `[urlhaus]` need `api_key`; `[misp]` needs +`url` AND `api_key`. Exactly one half of the MISP pair is +configured-and-broken rather than skipped, and `config.load()` reports it in +`incomplete` rather than raising: every subcommand loads this file, and +`parse` must not be refused over a section it never reads. `report` refuses +it, because that is the command that acts on it. + ## The provider table `init.PROVIDERS` holds each provider's published sending ranges, transcribed -- cgit v1.2.3