classifyre-cli 0.5.8__tar.gz → 0.5.10__tar.gz

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/.turbo/turbo-build.log

@@ -1,3 +1,3 @@
 $ uv sync
-Resolved 323 packages in 194ms
+Resolved 323 packages in 254ms
 Checked 51 packages in 1ms

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: classifyre-cli
-Version: 0.5.8
+Version: 0.5.10
 Summary: Classifyre CLI — scan and classify unstructured data sources
 License: MIT
 Keywords: data,ingestion,metadata,pii,secrets,unstructured

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classifyre/cli",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "private": true,
   "scripts": {
     "build": "uv sync",

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "classifyre-cli"
-version = "0.5.8"
+version = "0.5.10"
 description = "Classifyre CLI — scan and classify unstructured data sources"
 readme = "README.md"
 # Upper bound is load-bearing: onnxruntime publishes no cp315 wheels (notably

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/scripts/generate_sdk_completions.py

@@ -40,6 +40,7 @@ from src.notebook.sdk import (  # noqa: E402
     NotebookFile,
     ParsedContent,
     Ref,
+    Tag,
     contains,
     flow,
     pages,
@@ -251,6 +252,13 @@ def build() -> dict[str, Any]:
                 "documentation": _summary(Asset),
                 "insertText": "Asset",
             },
+            {
+                "label": "Tag",
+                "kind": "class",
+                "detail": 'Tag(value, severity="HIGH")',
+                "documentation": _summary(Tag),
+                "insertText": "Tag",
+            },
             {
                 "label": "Ref",
                 "kind": "class",
@@ -292,6 +300,10 @@ def build() -> dict[str, Any]:
                 "documentation": _summary(Asset),
                 "fields": _fields(Asset),
             },
+            "Tag": {
+                "documentation": _summary(Tag),
+                "fields": _fields(Tag),
+            },
             "AugmentedAsset": {
                 "documentation": _summary(augmentation_sdk.AugmentedAsset),
                 "members": _members(augmentation_sdk.AugmentedAsset),

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/detectors/custom/runners/_tag.py

@@ -28,6 +28,15 @@ from ._base import BaseRunner
 #: from, so an unreadable one falls back here rather than being guessed at.
 _DEFAULT_SEVERITY = Severity.medium
 
+#: Most severe first, so a lower index is a higher severity.
+_SEVERITY_ORDER: tuple[Severity, ...] = (
+    Severity.critical,
+    Severity.high,
+    Severity.medium,
+    Severity.low,
+    Severity.info,
+)
+
 
 class TagRunner(BaseRunner):
     """Placeholder pipeline: produces findings only from notebook-supplied tags."""
@@ -56,13 +65,39 @@ class TagRunner(BaseRunner):
         """No content type is supported, so the pipeline never schedules this."""
         return []
 
-    def tag_finding(self, value: str) -> DetectionResult:
-        """One finding for one value the notebook asserted under this key."""
+    def bound_severity(self, requested: str | Severity | None) -> tuple[Severity, bool]:
+        """The severity to use for one tag, and whether it had to be lowered.
+
+        The detector's own severity is a ceiling, not a default. A connector
+        that knows this instance is milder than usual may say so; one that
+        wants its findings to outrank what the operator configured may not,
+        because the detector is where that decision belongs. An unreadable or
+        over-severe request lands on the ceiling and the caller reports it,
+        rather than being applied or dropped in silence.
+        """
+        if requested is None:
+            return self.severity, False
+        asked = _parse_severity(requested)
+        if asked is None:
+            return self.severity, True
+        if _SEVERITY_ORDER.index(asked) < _SEVERITY_ORDER.index(self.severity):
+            return self.severity, True
+        return asked, False
+
+    def tag_finding(self, value: str, severity: str | Severity | None = None) -> DetectionResult:
+        """One finding for one value the notebook asserted under this key.
+
+        ``severity`` is what the connector *asked for*, not an already-bounded
+        value: the finding records both what was applied and what was refused,
+        so a capped tag can be explained from the finding itself rather than
+        from a log line nobody kept.
+        """
         text = str(value).strip()
+        applied, lowered = self.bound_severity(severity)
         return self._make_result(
             finding_type=f"tag:{self.label}",
             category="CLASSIFICATION",
-            severity=self.severity,
+            severity=applied,
             # Asserted by the connector, not inferred from content: there is
             # nothing here for a confidence score to express.
             confidence=1.0,
@@ -73,13 +108,33 @@ class TagRunner(BaseRunner):
                 "label": self.label,
                 "tag_key": self._detector_key,
                 "tag_value": text,
+                # Recorded so a finding whose severity differs from its
+                # detector's can be explained without re-reading the notebook.
+                **({"tag_severity": str(applied)} if applied != self.severity else {}),
+                # And when the connector asked for more than the detector
+                # allows, what it asked for. Without this the most interesting
+                # case -- a refused promotion -- left no trace on the finding
+                # at all, only a warning in a log.
+                **(
+                    {"tag_severity_requested": str(severity).strip().upper()}
+                    if lowered and severity is not None
+                    else {}
+                ),
             },
         )
 
 
-def _coerce_severity(value: object) -> Severity:
+def _parse_severity(value: object) -> Severity | None:
+    """The severity this value names, or None when it names none."""
     if isinstance(value, Severity):
         return value
-    if isinstance(value, str) and value in Severity.__members__:
-        return Severity(value)
-    return _DEFAULT_SEVERITY
+    if isinstance(value, str):
+        # The schema spells them lowercase; a notebook writes "HIGH".
+        name = value.strip().lower()
+        if name in Severity.__members__:
+            return Severity(name)
+    return None
+
+
+def _coerce_severity(value: object) -> Severity:
+    return _parse_severity(value) or _DEFAULT_SEVERITY

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/graph/edges.py

@@ -385,7 +385,13 @@ def flow(
     )
 
 
-def contains(parent: Ref, child: Ref, *, type: ContainmentType = ContainmentType.CONTAINS) -> Edge:
+def contains(
+    parent: Ref,
+    child: Ref,
+    *,
+    type: ContainmentType = ContainmentType.CONTAINS,
+    evidence: dict[str, Any] | None = None,
+) -> Edge:
     """``child`` is a part of ``parent`` -- structural, not temporal."""
     return Edge(
         frm=parent,
@@ -394,18 +400,32 @@ def contains(parent: Ref, child: Ref, *, type: ContainmentType = ContainmentType
         relation_type=str(type),
         method=Method.SYSTEM_CATALOG,
         confidence=1.0,
+        evidence=dict(evidence or {}),
     )
 
 
-def same_as(a: Ref, b: Ref, *, method: Method = Method.SYSTEM_CATALOG) -> Edge:
-    """The same real-world object, seen from two systems."""
+def same_as(
+    a: Ref,
+    b: Ref,
+    *,
+    method: Method = Method.SYSTEM_CATALOG,
+    confidence: float | None = None,
+    evidence: dict[str, Any] | None = None,
+) -> Edge:
+    """The same real-world object, seen from two systems.
+
+    ``evidence`` says why the match holds -- e.g. ``{"match": "alias", "checked_by": "hand"}``
+    for a crosswalk entry a person verified -- so a reader can weigh a MANUAL match
+    differently from a name heuristic.
+    """
     return Edge(
         frm=a,
         to=b,
         edge_class=EdgeClass.IDENTITY,
         relation_type="SAME_AS",
         method=method,
-        confidence=_confidence(method, None),
+        confidence=_confidence(method, confidence),
+        evidence=dict(evidence or {}),
     )
 
 
@@ -415,6 +435,8 @@ def references(
     *,
     type: ReferenceType = ReferenceType.REFERENCES,
     method: Method = Method.SYSTEM_CATALOG,
+    confidence: float | None = None,
+    evidence: dict[str, Any] | None = None,
 ) -> Edge:
     """``frm`` points at ``to``. No data moves -- a foreign key is not lineage."""
     return Edge(
@@ -423,7 +445,8 @@ def references(
         edge_class=EdgeClass.REFERENCE,
         relation_type=str(type),
         method=method,
-        confidence=_confidence(method, None),
+        confidence=_confidence(method, confidence),
+        evidence=dict(evidence or {}),
     )
 
 

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/notebook/sdk.py

@@ -31,10 +31,15 @@ from pathlib import Path
 from typing import IO, Any
 
 from ..graph.edges import (
+    ContainmentType,
     Edge,
     FieldMapping,
+    FieldTransform,
     FlowType,
+    Method,
     Ref,
+    ReferenceType,
+    UsageType,
     contains,
     flow,
     references,
@@ -53,6 +58,48 @@ CONTENT_TYPES = ("TXT", "TABLE", "IMAGE", "VIDEO", "AUDIO", "URL", "BINARY", "OT
 
 DEFAULT_KIND = "record"
 
+#: Most severe first. A tag's severity is bounded by its detector's, so this is
+#: also the order the bound is applied in.
+TAG_SEVERITIES = ("CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO")
+
+
+@dataclass(frozen=True)
+class Tag:
+    """A tag value that carries its own severity.
+
+    ``tags={"insolvencies_yoy": "+34%"}`` gives every asset the Tag detector's
+    own severity. That is right when the fact itself is the finding, and wrong
+    when the *degree* is: an early-warning rule reading "HIGH at +30%, MEDIUM at
+    +20%" needed two detectors with duplicated descriptions, and every inquiry
+    and case had to name both keys (GENESIS field report P9). Written instead
+    as::
+
+        Asset(tags={"insolvencies_yoy": Tag("+34%", severity="HIGH")})
+
+    one detector covers the rule and the finding carries the band.
+
+    The detector's configured severity is the ceiling, never the default: a
+    connector can say "this instance matters less than usual" but cannot
+    promote its own findings past what the operator who created the detector
+    allowed. A severity above the ceiling is lowered to it and reported as a
+    scan warning rather than silently applied or dropped.
+    """
+
+    value: str
+    severity: str | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "value", str(self.value).strip())
+        raw = self.severity
+        if raw is None:
+            return
+        normalized = str(raw).strip().upper()
+        if normalized not in TAG_SEVERITIES:
+            raise ValueError(
+                f"Tag severity must be one of {', '.join(TAG_SEVERITIES)}, got {raw!r}"
+            )
+        object.__setattr__(self, "severity", normalized)
+
 
 @dataclass
 class Asset:
@@ -95,7 +142,15 @@ class Asset:
     #: when the source system already has the answer and running a classifier
     #: over the content could only re-derive it less reliably. A key with no
     #: matching Tag detector is reported as a scan warning and skipped.
+    #:
+    #: A value may also be a :class:`Tag`, which carries a severity for that one
+    #: assertion: ``tags={"insolvencies_yoy": Tag("+34%", severity="HIGH")}``.
     tags: dict[str, str] = field(default_factory=dict)
+    #: Per-tag severity overrides, keyed exactly like ``tags``. Filled in from
+    #: any :class:`Tag` values above rather than written directly, so ``tags``
+    #: keeps its plain ``{key: value}`` shape for everything that already reads
+    #: it. Bounded by each detector's own severity when the finding is built.
+    tag_severities: dict[str, str] = field(default_factory=dict)
     #: ``False`` records the asset without extracting or scanning its content:
     #: ``Asset(id=..., metadata={...}, extract=False, reference_reason="...")``.
     #: Use it for an artefact whose existence and metadata matter but whose
@@ -139,7 +194,7 @@ class Asset:
                 f"{type(self.content_bytes).__name__}); encode text first"
             )
         self.links = [str(link) for link in self.links if str(link).strip()]
-        self.tags = _normalize_tags(self.tags)
+        self.tags, self.tag_severities = _normalize_tags(self.tags)
         if self.cohort is not None:
             if not isinstance(self.cohort, CohortItem):
                 raise TypeError("Asset.cohort must be an item from ctx.cohort()")
@@ -166,15 +221,19 @@ class Asset:
             )
 
 
-def _normalize_tags(value: Any) -> dict[str, str]:
+def _normalize_tags(value: Any) -> tuple[dict[str, str], dict[str, str]]:
     """Accept the two shapes an author reasonably writes, reject the rest.
 
     A dict is the ordinary case. A sequence of pairs is accepted because it is
     what someone reaches for to assert two values under one key, and silently
     keeping only the last one would be worse than supporting it.
+
+    Returns the values and, separately, the severities any :class:`Tag` entries
+    asked for. Splitting them keeps ``Asset.tags`` a plain ``{key: value}`` map
+    for the adapter, the checksum and every reader that predates severities.
     """
     if not value:
-        return {}
+        return {}, {}
     if isinstance(value, Mapping):
         items: Iterable[Any] = value.items()
     elif isinstance(value, str | bytes):
@@ -191,6 +250,7 @@ def _normalize_tags(value: Any) -> dict[str, str]:
             ) from None
 
     tags: dict[str, str] = {}
+    severities: dict[str, str] = {}
     for item in items:
         if isinstance(item, Mapping):
             pair: Any = (item.get("key"), item.get("value"))
@@ -203,6 +263,10 @@ def _normalize_tags(value: Any) -> dict[str, str]:
                 f"Asset.tags entries must be (detector key, value) pairs; got {item!r}"
             ) from None
         key = str(key or "").strip()
+        severity: str | None = None
+        if isinstance(tag_value, Tag):
+            severity = tag_value.severity
+            tag_value = tag_value.value
         tag_value = str("" if tag_value is None else tag_value).strip()
         if not key or not tag_value:
             continue
@@ -211,7 +275,15 @@ def _normalize_tags(value: Any) -> dict[str, str]:
         # one silently would lose the other.
         existing = tags.get(key)
         tags[key] = f"{existing}, {tag_value}" if existing else tag_value
-    return tags
+        if severity is None:
+            continue
+        # Joined values share one finding, so they share one severity: the most
+        # severe of the two, because lowering it would understate a fact the
+        # connector asserted.
+        current = severities.get(key)
+        if current is None or TAG_SEVERITIES.index(severity) < TAG_SEVERITIES.index(current):
+            severities[key] = severity
+    return tags, severities
 
 
 def urn_for(platform: str, authority: str, *path: str) -> str:
@@ -629,6 +701,7 @@ class Context:
         select: Iterable[str] = (),
         limit: int = 1000,
         cursor: str | None = None,
+        cohort: bool = True,
     ) -> AssetQueryPage:
         """Read assets another source in this namespace already wrote.
 
@@ -658,6 +731,13 @@ class Context:
         Calling it declares this run's coverage partial, since a connector that
         picks its cohort from a query never sees the rest of its source.
         Available during scans only, not when running a cell in the editor.
+
+        Pass ``cohort=False`` when the query only supplies *inputs* and this run
+        still yields its whole universe -- e.g. Land aggregates computed from
+        every district profile. Coverage then stays complete, so an asset the
+        notebook stops yielding is retired. Without it such a source could never
+        retire anything (GENESIS field report P5). Fail the run rather than
+        yield a partial universe if the input is incomplete.
         """
         if self._query_assets is None:
             raise AssetQueryError(
@@ -701,7 +781,7 @@ class Context:
             payload["cursor"] = str(cursor)
 
         response = self._query_assets(payload) or {}
-        if not self._partial_coverage:
+        if cohort and not self._partial_coverage:
             # Only on success: a refused query read nothing, so the run still
             # covers what it covers. Never over the notebook's own reason.
             self.set_partial_coverage("the notebook chose its cohort with ctx.query_assets()")
@@ -730,8 +810,12 @@ class Context:
         """
         return bool(self._should_abort())
 
-    def log(self, *parts: Any) -> None:
-        self._logger(" ".join(str(part) for part in parts))
+    def log(self, *parts: Any, level: str | None = None) -> None:
+        """Write a line to the run log. ``level`` ("warning", "error", …) sets its level there."""
+        message = " ".join(str(part) for part in parts)
+        if level:
+            message = f"{level.strip().upper()}: {message}"
+        self._logger(message)
 
     @staticmethod
     def now() -> datetime:
@@ -743,9 +827,19 @@ def build_module(context: Context) -> types.ModuleType:
     module = types.ModuleType(MODULE_NAME)
     module.__doc__ = "Runtime helpers available to a Classifyre custom connector."
     module.Asset = Asset  # type: ignore[attr-defined]
+    # A tag value that carries its own severity, so one detector can cover a
+    # banded rule instead of one detector per band (field report P9).
+    module.Tag = Tag  # type: ignore[attr-defined]
     module.Ref = Ref  # type: ignore[attr-defined]
     module.FieldMapping = FieldMapping  # type: ignore[attr-defined]
     module.FlowType = FlowType  # type: ignore[attr-defined]
+    # The enums the edge builders take. A string worked only because they are
+    # StrEnums; a typo in one failed at ingest, not at import (field report P11).
+    module.Method = Method  # type: ignore[attr-defined]
+    module.ReferenceType = ReferenceType  # type: ignore[attr-defined]
+    module.ContainmentType = ContainmentType  # type: ignore[attr-defined]
+    module.FieldTransform = FieldTransform  # type: ignore[attr-defined]
+    module.UsageType = UsageType  # type: ignore[attr-defined]
     module.flow = flow  # type: ignore[attr-defined]
     module.contains = contains  # type: ignore[attr-defined]
     module.references = references  # type: ignore[attr-defined]
@@ -765,11 +859,17 @@ def build_module(context: Context) -> types.ModuleType:
     module.__all__ = [  # type: ignore[attr-defined]
         "Asset",
         "Context",
+        "ContainmentType",
         "FieldMapping",
+        "FieldTransform",
         "FlowType",
+        "Method",
         "NotebookFile",
         "ParsedContent",
         "Ref",
+        "ReferenceType",
+        "Tag",
+        "UsageType",
         "contains",
         "ctx",
         "flow",
@@ -802,9 +902,11 @@ def namespace(context: Context) -> dict[str, Any]:
         "__name__": "classifyre_notebook",
         "__builtins__": __builtins__,
         "Asset": Asset,
+        "Tag": Tag,
         "Ref": Ref,
         "FieldMapping": FieldMapping,
         "FlowType": FlowType,
+        "Method": Method,
         "flow": flow,
         "contains": contains,
         "references": references,

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/pipeline/content_provider.py

@@ -18,6 +18,10 @@ class ContentProvider(Protocol):
 
     def asset_tags(self, asset_hash: str) -> Mapping[str, str]: ...
 
+    def asset_tag_severities(self, asset_hash: str) -> Mapping[str, str]: ...
+
+    def asserts_complete_tags(self, asset_hash: str) -> bool: ...
+
     def enrich_finding_location(
         self,
         finding: DetectionResult,

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/pipeline/detector_pipeline.py

@@ -1162,11 +1162,15 @@ class DetectorPipeline:
 
         A tag is the one finding that does not come from reading anything. The
         connector already knew the answer; the Tag detector named by the key
-        supplies the label and severity, and the value the connector supplied
-        becomes the matched content.
+        supplies the label and the severity ceiling, and the value the
+        connector supplied becomes the matched content. A ``Tag(value,
+        severity=)`` may lower the severity of its own finding within that
+        ceiling (field report P9).
         """
         tags = self.content_provider.asset_tags(str(asset.hash))
-        if not tags:
+        severities = self._asset_tag_severities(str(asset.hash))
+        complete = self._asserts_complete_tags(str(asset.hash))
+        if not tags and not complete:
             return [], [], []
 
         runners = self._tag_runners(detectors)
@@ -1181,20 +1185,66 @@ class DetectorPipeline:
                 # deleted. Silence would look like the tag simply not working,
                 # so name the key and what was available instead.
                 available = ", ".join(sorted(runners)) or "none configured"
-                warnings.append(
+                msg = (
                     f"Tag '{key}' on asset '{asset.name}' matches no Tag detector "
                     f"and was skipped (available: {available})"
                 )
+                logger.warning(msg)
+                warnings.append(msg)
                 continue
             detector, runner = entry
-            finding = runner.tag_finding(value)
+            requested = severities.get(key)
+            applied, lowered = runner.bound_severity(requested)
+            if lowered:
+                # The detector's severity is the ceiling. Saying so is the
+                # point: a connector that thinks it raised a finding to
+                # CRITICAL and silently did not would act on the wrong
+                # severity for as long as nobody checked. Logged as well as
+                # collected, because scan warnings live on the asset and the
+                # runner log is where an operator actually looks.
+                msg = (
+                    f"Tag '{key}' on asset '{asset.name}' asked for severity "
+                    f"{requested!r}, which its detector does not allow; "
+                    f"recorded as {str(applied).upper()}"
+                )
+                logger.warning(msg)
+                warnings.append(msg)
+            # The raw request, not `applied`: tag_finding bounds it again and
+            # records what was refused on the finding itself.
+            finding = runner.tag_finding(value, requested)
             self.content_provider.enrich_finding_location(finding, asset, "")
             findings.append(finding)
             self._record_outcome(outcome_sink, detector, None)
             types_run = self._merge_detector_types(types_run, [DetectorType.CUSTOM])
 
+        if complete:
+            # The source's tag set is complete, so an absent key is an answer:
+            # this detector found nothing on this asset. Recording OK lets the
+            # API resolve what it found in an earlier run. Without it a fact
+            # the connector withdrew stayed an open finding for as long as the
+            # asset lived (GENESIS field report P4).
+            for key, (detector, _runner) in runners.items():
+                if key not in tags:
+                    self._record_outcome(outcome_sink, detector, None)
+                    types_run = self._merge_detector_types(types_run, [DetectorType.CUSTOM])
+
         return findings, warnings, types_run
 
+    def _asset_tag_severities(self, asset_hash: str) -> dict[str, str]:
+        """Per-tag severities this source asked for, or nothing.
+
+        Probed rather than called outright: a provider written before Tag
+        severities existed still satisfies the pipeline's contract.
+        """
+        probe = getattr(self.content_provider, "asset_tag_severities", None)
+        if not callable(probe):
+            return {}
+        return dict(probe(asset_hash) or {})
+
+    def _asserts_complete_tags(self, asset_hash: str) -> bool:
+        probe = getattr(self.content_provider, "asserts_complete_tags", None)
+        return bool(probe(asset_hash)) if callable(probe) else False
+
     @staticmethod
     def _tag_runners(detectors: list[BaseDetector]) -> dict[str, tuple[BaseDetector, Any]]:
         """Tag detectors in this run, keyed by the key a notebook writes."""

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/pipeline/parsed_content_provider.py

@@ -91,6 +91,12 @@ class ParsedContentProvider:
     def asset_tags(self, asset_hash: str) -> Mapping[str, str]:
         return self._source.asset_tags(asset_hash)
 
+    def asset_tag_severities(self, asset_hash: str) -> Mapping[str, str]:
+        return self._source.asset_tag_severities(asset_hash)
+
+    def asserts_complete_tags(self, asset_hash: str) -> bool:
+        return self._source.asserts_complete_tags(asset_hash)
+
     def extracts_content(self, asset_hash: str) -> bool:
         return self._source.extracts_content(asset_hash)
 

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/sources/base.py

@@ -592,6 +592,25 @@ class BaseSource(ABC):
         with self._augmentation_tags_lock:
             return dict(self._augmentation_tags.get(asset_hash, {}))
 
+    def asset_tag_severities(self, asset_hash: str) -> Mapping[str, str]:
+        """Per-tag severity overrides, for the keys a connector set one on.
+
+        Only the CUSTOM notebook can express one today (``Tag(value,
+        severity=)``); every other source leaves the Tag detector's own
+        severity in force, which is what an empty mapping means here.
+        """
+        return {}
+
+    def asserts_complete_tags(self, asset_hash: str) -> bool:
+        """Whether ``asset_tags`` is the *whole* truth about this asset.
+
+        When it is, a Tag detector whose key is absent has positively found
+        nothing, and a finding it produced earlier must resolve. Only a
+        connector that re-derives every tag on every run can promise that; an
+        augmentation notebook may tag a subset, so the default is False.
+        """
+        return False
+
     def enrich_finding_location(
         self,
         finding: DetectionResult,

{classifyre_cli-0.5.8 → classifyre_cli-0.5.10}/src/sources/custom/runner.py

@@ -17,6 +17,7 @@ import base64
 import itertools
 import json
 import random
+import re
 import signal
 import sys
 from dataclasses import asdict
@@ -42,6 +43,11 @@ from ...notebook.serialize import (
     to_module_source,
 )
 
+# The run log's level prefixes (runner-log-storage.service.ts matchLevelPrefix).
+_LEVEL_PREFIX = re.compile(
+    r"^\s*\[?(TRACE|DEBUG|INFO|WARNING|WARN|ERROR|FATAL|CRITICAL)\]?\s*[:\-|\s]", re.I
+)
+
 ITEM = "item"
 END = "end"
 ERROR = "error"
@@ -159,7 +165,12 @@ class NotebookRuntime:
     @staticmethod
     def _log(message: str) -> None:
         # ctx.log goes to stderr: stdout is the data channel, and a notebook
-        # that logs would otherwise corrupt the asset stream.
+        # that logs would otherwise corrupt the asset stream. The run log infers
+        # a line's level from its prefix; without one every notebook line was
+        # stored as UNKNOWN and vanished under any level filter (GENESIS field
+        # report P11). A line that already names its level keeps it.
+        if not _LEVEL_PREFIX.match(message):
+            message = f"INFO:notebook: {message}"
         print(message, file=sys.stderr, flush=True)
 
     def load(self) -> None: