test(discovery): match manifest entries to reported assets - #62
Closed
pengyuzhang wants to merge 1 commit into
Closed
test(discovery): match manifest entries to reported assets#62pengyuzhang wants to merge 1 commit into
pengyuzhang wants to merge 1 commit into
Conversation
The join between what was installed and what was reported, by entry shape
rather than by category: an installed tool by catalog id, a declared server by
what it launches, an artifact by its path, a state by the asset it attaches to.
Getting this wrong is expensive in both directions - a missed join reads as a
miss the collector never made, and a loose join hides a real one - so every
rule is narrow and every fallback explicit.
Four rules earn their complexity. A channel variant joins through its base
entry's catalog id, because the whole point of those rows is that a second
install must not become a second asset. The fourteen M-SITE rows declare the
same server on purpose, so the config file they wrote is part of the key -
keying on the launch line alone would make all fourteen match all fourteen and
report a duplicate on every row. Two schedulers running one command are
separated by their backend rather than by the command. And a negative control
only claims an asset by name when it declares no path of its own: an MCP server
legitimately called usage: git [-v | --version] [-h | --help] [-C <path>] [-c <name>=<value>]
[--exec-path[=<path>]] [--html-path] [--man-path] [--info-path]
[-p | --paginate | -P | --no-pager] [--no-replace-objects] [--no-lazy-fetch]
[--no-optional-locks] [--no-advice] [--bare] [--git-dir=<path>]
[--work-tree=<path>] [--namespace=<name>] [--config-env=<name>=<envvar>]
<command> [<args>]
These are common Git commands used in various situations:
start a working area (see also: git help tutorial)
clone Clone a repository into a new directory
init Create an empty Git repository or reinitialize an existing one
work on the current change (see also: git help everyday)
add Add file contents to the index
mv Move or rename a file, a directory, or a symlink
restore Restore working tree files
rm Remove files from the working tree and from the index
examine the history and state (see also: git help revisions)
bisect Use binary search to find the commit that introduced a bug
diff Show changes between commits, commit and working tree, etc
grep Print lines matching a pattern
log Show commit logs
show Show various types of objects
status Show the working tree status
grow, mark and tweak your common history
backfill Download missing objects in a partial clone
branch List, create, or delete branches
commit Record changes to the repository
merge Join two or more development histories together
rebase Reapply commits on top of another base tip
reset Reset current HEAD to the specified state
switch Switch branches
tag Create, list, delete or verify a tag object signed with GPG
collaborate (see also: git help workflows)
fetch Download objects and refs from another repository
pull Fetch from and integrate with another repository or a local branch
push Update remote refs along with associated objects
'git help -a' and 'git help -g' list available subcommands and some
concept guides. See 'git help <command>' or 'git help <concept>'
to read about a specific subcommand or concept.
See 'git help git' for an overview of the system. is not the usage: git [-v | --version] [-h | --help] [-C <path>] [-c <name>=<value>]
[--exec-path[=<path>]] [--html-path] [--man-path] [--info-path]
[-p | --paginate | -P | --no-pager] [--no-replace-objects] [--no-lazy-fetch]
[--no-optional-locks] [--no-advice] [--bare] [--git-dir=<path>]
[--work-tree=<path>] [--namespace=<name>] [--config-env=<name>=<envvar>]
<command> [<args>]
These are common Git commands used in various situations:
start a working area (see also: git help tutorial)
clone Clone a repository into a new directory
init Create an empty Git repository or reinitialize an existing one
work on the current change (see also: git help everyday)
add Add file contents to the index
mv Move or rename a file, a directory, or a symlink
restore Restore working tree files
rm Remove files from the working tree and from the index
examine the history and state (see also: git help revisions)
bisect Use binary search to find the commit that introduced a bug
diff Show changes between commits, commit and working tree, etc
grep Print lines matching a pattern
log Show commit logs
show Show various types of objects
status Show the working tree status
grow, mark and tweak your common history
backfill Download missing objects in a partial clone
branch List, create, or delete branches
commit Record changes to the repository
merge Join two or more development histories together
rebase Reapply commits on top of another base tip
reset Reset current HEAD to the specified state
switch Switch branches
tag Create, list, delete or verify a tag object signed with GPG
collaborate (see also: git help workflows)
fetch Download objects and refs from another repository
pull Fetch from and integrate with another repository or a local branch
push Update remote refs along with associated objects
'git help -a' and 'git help -g' list available subcommands and some
concept guides. See 'git help <command>' or 'git help <concept>'
to read about a specific subcommand or concept.
See 'git help git' for an overview of the system. binary N-04 installed, and
attributing it would turn a correct report into a fabricated false positive.
Redacted arguments compare as wildcards. The manifest holds the plaintext a
config was written with and the snapshot holds the collector's redaction of it;
requiring equality would score every credential-carrying entry as a miss and
punish the collector for doing the right thing.
lghupan
approved these changes
Aug 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #61.
The join between what was installed and what was reported. Matching is by entry shape, not by category:
installdeclarecreatestateGetting this wrong is expensive in both directions: a missed join reads as a miss the collector never made, and a loose join hides a real one. So every rule is narrow, every fallback is explicit, and each has a test that fails if it is relaxed.
Four rules that earn their complexity
A channel variant joins through its base entry's catalog id.
T-CHAN-04has none of its own. If it matched nothing it would score as a miss and hide the duplicate it exists to provoke.The site is part of the key for declarations. The fourteen
M-SITErows declare the same trivial server on purpose, so that a missed site shows as a specific miss rather than a lower total. Keying on the launch line alone would make all fourteen match all fourteen and report a duplicate on every one. Corollary: a site that names a file and finds nothing there is a miss, not a fallback to the other thirteen.Two schedulers running one command are separated by their backend.
AG-05(cron) andAG-06(systemd) run the identical command deliberately — the question is whether the collector reads both surfaces. Matching on the command reports two duplicates where there are none.A negative control claims by name only when it declares no path. An MCP server legitimately called
gitis not thegitbinaryN-04installed. Attributing it would turn a correct report into a fabricated false positive.Redacted arguments are wildcards
The manifest holds the plaintext a config was written with; the snapshot holds the collector's redaction of it. Requiring those to be equal would score every credential-carrying entry as a miss — punishing the collector for doing the right thing.
Verification