feat(manifest): add per-file digest provenance

.gitattributes

@@ -0,0 +1,4 @@
+/configs/** text eol=lf
+/data/raw/** text eol=lf
+/demos/**/config/** text eol=lf
+/demos/**/data/raw/** text eol=lf

configs/default.yaml

@@ -1,47 +1,47 @@
-input_path: data/raw/sample_events.jsonl
-output_dir: data/processed
-
-time:
-  timestamp_col: timestamp
-  window_size_seconds: 60
-  step_size_seconds: 10
-
-features:
-  count_event_types:
-    - login_fail
-    - login_success
-    - config_change
-    - malware_alert
-    - policy_denied
-  error_statuses:
-    - fail
-    - blocked
-  severity_levels:
-    - high
-    - critical
-
+input_path: data/raw/sample_events.jsonl
+output_dir: data/processed
+
+time:
+  timestamp_col: timestamp
+  window_size_seconds: 60
+  step_size_seconds: 10
+
+features:
+  count_event_types:
+    - login_fail
+    - login_success
+    - config_change
+    - malware_alert
+    - policy_denied
+  error_statuses:
+    - fail
+    - blocked
+  severity_levels:
+    - high
+    - critical
+
 rules:
   cooldown_seconds: 60
   high_error_rate:
     threshold: 0.30
     severity: medium
-  login_fail_burst:
-    threshold: 8
-    severity: high
-  high_severity_spike:
-    threshold: 3
-    severity: high
-  persistent_high_error:
-    threshold: 0.25
-    consecutive_windows: 2
-    severity: medium
-  source_spread_spike:
-    absolute_threshold: 10
-    multiplier: 1.3
-    severity: medium
-  rare_event_repeat:
-    threshold: 2
-    event_types:
-      - malware_alert
-      - policy_denied
-    severity: high
+  login_fail_burst:
+    threshold: 8
+    severity: high
+  high_severity_spike:
+    threshold: 3
+    severity: high
+  persistent_high_error:
+    threshold: 0.25
+    consecutive_windows: 2
+    severity: medium
+  source_spread_spike:
+    absolute_threshold: 10
+    multiplier: 1.3
+    severity: medium
+  rare_event_repeat:
+    threshold: 2
+    event_types:
+      - malware_alert
+      - policy_denied
+    severity: high

data/processed/richer_sample/run_manifest.json

@@ -3,6 +3,12 @@
   "demo_id": "window",
   "input_digest": "sha256:e8771283a83c146a2cffce5fe316c1408200b6d7717cbb6d074334aa891672f3",
   "config_digest": "sha256:e7cb0264262cc997edf8f6b987dc0466098f23150d0c6204fb5fd7c245df1d7d",
+  "input_file_digests": {
+    "data/raw/richer_sample_events.jsonl": "sha256:c9b3ec9425c2f4bb9e9245780b46632de046bf8b3428a28a284b746ca1ffde5d"
+  },
+  "config_file_digests": {
+    "configs/richer_sample.yaml": "sha256:c6a703ee805faed5d97c36727689c624942f6171d21f7ea1a047a01ccdac1398"
+  },
   "artifact_schema_versions": {
     "run_manifest": "run-manifest/v1",
     "telemetry_summary": "telemetry-summary/v1"

data/processed/run_manifest.json

@@ -3,6 +3,12 @@
   "demo_id": "window",
   "input_digest": "sha256:c08795a6a3c361a3339414c5a8441fb74c58f027c96931dbdc0da28560e132ac",
   "config_digest": "sha256:b02cfeb006b05c52f075c3aa454045cd4c46b25be5576e37e184c3f02bf9328b",
+  "input_file_digests": {
+    "data/raw/sample_events.jsonl": "sha256:6872d0676edc12d572875bec549fcb8b4cf813dbfc332ae4f014842d985a1e97"
+  },
+  "config_file_digests": {
+    "configs/default.yaml": "sha256:89242ab3940666dc9d0f3bb6bb996b93a5c17908b8edb0844e539390bf555129"
+  },
   "artifact_schema_versions": {
     "run_manifest": "run-manifest/v1",
     "telemetry_summary": "telemetry-summary/v1"

demos/ai-assisted-detection-demo/artifacts/run_manifest.json

@@ -3,6 +3,13 @@
   "demo_id": "ai-assisted",
   "input_digest": "sha256:e45f71682c89734e625119a3edd166591f1a0cdf6e3b24c7b87c23d809154b55",
   "config_digest": "sha256:183924db1f5800b56ec2794198d65489c49c0824823b52ef373bb30011886408",
+  "input_file_digests": {
+    "demos/ai-assisted-detection-demo/data/raw/sample_security_events.jsonl": "sha256:848a15c0118467e45f275db8942debf343cf730b04d98e6e9456b19aac8f5cb3"
+  },
+  "config_file_digests": {
+    "demos/ai-assisted-detection-demo/config/llm_case_output_schema.json": "sha256:404fc3435b43639075c2034d6822aa1bcbb016b25f26143a7d1b6f58c3ce7ac0",
+    "demos/ai-assisted-detection-demo/config/rules.yaml": "sha256:b58eb095eab63b38e0c88141a70ee751f3b27d360c56fb779fd5c6f1c1476925"
+  },
   "artifact_schema_versions": {
     "ai_audit_traces": "ai-assisted-detection-audit/v1",
     "case_bundles": "case-bundles/v1",

demos/ai-assisted-detection-demo/config/llm_case_output_schema.json

@@ -1,64 +1,64 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "x_schema_version": "ai-assisted-case-summary/v1",
-  "title": "AiAssistedCaseSummary",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "case_id",
-    "summary",
-    "likely_causes",
-    "uncertainty_notes",
-    "suggested_next_steps",
-    "human_verification",
-    "scope_guardrail"
-  ],
-  "properties": {
-    "case_id": {
-      "type": "string",
-      "minLength": 1
-    },
-    "summary": {
-      "type": "string",
-      "minLength": 1
-    },
-    "likely_causes": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 3,
-      "items": {
-        "type": "string",
-        "minLength": 1
-      }
-    },
-    "uncertainty_notes": {
-      "type": "array",
-      "minItems": 1,
-      "items": {
-        "type": "string",
-        "minLength": 1
-      }
-    },
-    "suggested_next_steps": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 4,
-      "items": {
-        "type": "string",
-        "minLength": 1
-      }
-    },
-    "human_verification": {
-      "type": "string",
-      "enum": [
-        "required"
-      ]
-    },
-    "scope_guardrail": {
-      "type": "string",
-      "enum": [
-        "no_final_incident_decision|no_rule_changes|no_automated_actions"
-      ]
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "x_schema_version": "ai-assisted-case-summary/v1",
+  "title": "AiAssistedCaseSummary",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "case_id",
+    "summary",
+    "likely_causes",
+    "uncertainty_notes",
+    "suggested_next_steps",
+    "human_verification",
+    "scope_guardrail"
+  ],
+  "properties": {
+    "case_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "summary": {
+      "type": "string",
+      "minLength": 1
+    },
+    "likely_causes": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 3,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "uncertainty_notes": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "suggested_next_steps": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 4,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "human_verification": {
+      "type": "string",
+      "enum": [
+        "required"
+      ]
+    },
+    "scope_guardrail": {
+      "type": "string",
+      "enum": [
+        "no_final_incident_decision|no_rule_changes|no_automated_actions"
+      ]
+    }
+  }
+}

demos/ai-assisted-detection-demo/config/rules.yaml

@@ -1,59 +1,59 @@
-case_grouping:
-  gap_minutes: 15
-  context_minutes: 2
-
-rules:
-  - rule_id: AUTH-001
-    name: repeated_failed_logins
-    type: auth_fail_burst
-    severity: medium
-    family: auth
-    threshold: 4
-    lookback_minutes: 5
-    attack:
-      tactic: Credential Access
-      technique_id: T1110
-      technique_name: Brute Force
-
-  - rule_id: AUTH-002
-    name: successful_login_after_failures
-    type: auth_success_after_failures
-    severity: high
-    family: auth
-    failure_threshold: 3
-    lookback_minutes: 10
-    attack:
-      tactic: Credential Access
-      technique_id: T1078
-      technique_name: Valid Accounts
-
-  - rule_id: WEB-001
-    name: sensitive_path_scan
-    type: web_sensitive_path_scan
-    severity: medium
-    family: web
-    threshold: 3
-    lookback_minutes: 5
-    risky_paths:
-      - /admin
-      - /wp-admin
-      - /.env
-    attack:
-      tactic: Reconnaissance
-      technique_id: T1595
-      technique_name: Active Scanning
-
-  - rule_id: PROC-001
-    name: encoded_powershell_execution
-    type: process_encoded_command
-    severity: high
-    family: process
-    indicators:
-      - -enc
-      - frombase64string
-      - invoke-expression
-      - iex(
-    attack:
-      tactic: Execution
-      technique_id: T1059.001
-      technique_name: PowerShell
+case_grouping:
+  gap_minutes: 15
+  context_minutes: 2
+
+rules:
+  - rule_id: AUTH-001
+    name: repeated_failed_logins
+    type: auth_fail_burst
+    severity: medium
+    family: auth
+    threshold: 4
+    lookback_minutes: 5
+    attack:
+      tactic: Credential Access
+      technique_id: T1110
+      technique_name: Brute Force
+
+  - rule_id: AUTH-002
+    name: successful_login_after_failures
+    type: auth_success_after_failures
+    severity: high
+    family: auth
+    failure_threshold: 3
+    lookback_minutes: 10
+    attack:
+      tactic: Credential Access
+      technique_id: T1078
+      technique_name: Valid Accounts
+
+  - rule_id: WEB-001
+    name: sensitive_path_scan
+    type: web_sensitive_path_scan
+    severity: medium
+    family: web
+    threshold: 3
+    lookback_minutes: 5
+    risky_paths:
+      - /admin
+      - /wp-admin
+      - /.env
+    attack:
+      tactic: Reconnaissance
+      technique_id: T1595
+      technique_name: Active Scanning
+
+  - rule_id: PROC-001
+    name: encoded_powershell_execution
+    type: process_encoded_command
+    severity: high
+    family: process
+    indicators:
+      - -enc
+      - frombase64string
+      - invoke-expression
+      - iex(
+    attack:
+      tactic: Execution
+      technique_id: T1059.001
+      technique_name: PowerShell