Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #173 +/- ##
==========================================
+ Coverage 83.64% 83.74% +0.10%
==========================================
Files 89 89
Lines 5680 5716 +36
==========================================
+ Hits 4751 4787 +36
Misses 929 929
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Two corrections to the scoring cascade. Both change which rule id is recorded rather than the scores themselves. top_*_rule_id was argMax(rule_id, blocked). On a measurement that is not blocked the key is 0 on every row, so argMax kept whichever row it saw first. Every web_connectivity measurement carries one row per resolved IP plus one per redirect hop, and the redirect rows hold only HTTP, so they scored no_tls_data and were winning that tie. Rules now carry an Evidence level and are ranked on it before the score. DNS scoring was restricted to the system resolver and its window partitioned without the resolver, so every DNS signal was constant across a measurement and a row whose address came from another resolver inherited the system resolver's verdict. dns_untrusted is replaced by endpoint_untrusted, which additionally requires that nothing independent vouches for the address: either the control returned it too, or somebody completed a valid handshake for the expected name on it. RULES_VERSION goes to 2, so rows written before and after are distinguishable. Measured over a 10-minute production window (9,731 measurements), rescoring with the new code moves no *_blocked score and three rule ids, all tcp: endpoint_untrusted -> none. The new condition is strictly narrower than the one it replaces, so it can only unmask rows, never mask new ones. It is close to a no-op until web_connectivity 0.5 measurements reach the pipeline, which is what makes it safe to land first. Reprocessing steps are in the migration notes.
hellais
commented
Aug 11, 2026
| report_id, | ||
| hostname, | ||
| input, | ||
| probe_asn, probe_as_org_name, probe_cc, resolver_asn, resolver_as_cc, network_type, |
Member
Author
There was a problem hiding this comment.
In here we need to also add special treatment for non getaddrinfo and system resolvers. Depending on the engine type we want to then map resolver_asn and resolver_as_cc to the correct value depending on the dns_engine_resolver_address. It's also probably worth exposing an additional field which signals if the resolver is encrypted or not, since querying using an encrypted resolver has significantly different consequences than querying using a non-encrypted one.
hellais
commented
Aug 11, 2026
| NONE = 0 # layer produced no data on this row | ||
| DISCARDED = 1 # observed, but an earlier layer makes it uninterpretable | ||
| SCORED = 2 # observed and scored | ||
|
|
Member
Author
There was a problem hiding this comment.
This whole block needs to be removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two corrections to the scoring cascade. Both change which rule id is recorded rather than the scores themselves.
top_*_rule_id was argMax(rule_id, blocked). On a measurement that is not blocked the key is 0 on every row, so argMax kept whichever row it saw first. Every web_connectivity measurement carries one row per resolved IP plus one per redirect hop, and the redirect rows hold only HTTP, so they scored no_tls_data and were winning that tie. Rules now carry an Evidence level and are ranked on it before the score.
DNS scoring was restricted to the system resolver and its window partitioned without the resolver, so every DNS signal was constant across a measurement and a row whose address came from another resolver inherited the system resolver's verdict. dns_untrusted is replaced by endpoint_untrusted, which additionally requires that nothing independent vouches for the address: either the control returned it too, or somebody completed a valid handshake for the expected name on it.
RULES_VERSION goes to 2, so rows written before and after are distinguishable. Measured over a 10-minute production window (9,731 measurements), rescoring with the new code moves no *_blocked score and three rule ids, all tcp: endpoint_untrusted -> none. The new condition is strictly narrower than the one it replaces, so it can only unmask rows, never mask new ones. It is close to a no-op until web_connectivity 0.5 measurements reach the pipeline, which is what makes it safe to land first. Reprocessing steps are in the migration notes.