Add typed detection metadata to memory notes#182
Merged
Conversation
Copilot
AI
changed the title
[WIP] Add typed DetectionMeta extension to MemoryNote.Metadata
Add typed detection metadata to memory notes
Jul 2, 2026
…etectionmeta-extension
…d formatting The bulk-ingest test doubles' remember() signatures predate the new metadata parameter, so every fixture errored per-file and bulk ingest silently ingested zero rules. Also sort sqlite_backend imports and apply ruff formatting so the CI lint gate passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqYpmV8TABMzq27HBTLtNP
rolandpg
marked this pull request as ready for review
July 7, 2026 02:16
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…etectionmeta-extension
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
- construct(): a partial caller Metadata (e.g. only detection set) no longer lands in the default domain — domain/tier fall back to the construct() arguments unless explicitly set, via model_fields_set. - remember(): reject metadata= combined with evolve=True instead of silently dropping it; the extraction pipeline produces multiple fact notes and cannot carry a single caller Metadata. - sigma/yara ingest: re-ingesting an unchanged rule now backfills the detection slot on notes written before DetectionMeta existed, so existing installations gain typed metadata without re-creating notes. Regression tests added for all three. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqYpmV8TABMzq27HBTLtNP
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Deep-copy a caller-supplied Metadata in construct() so reusing one template across several remember() calls cannot cross-mutate notes. Detection backfill on re-ingest now prefers rewrite_note (falling back to write_note) so updated_at reflects the metadata change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqYpmV8TABMzq27HBTLtNP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Detection-rule ingest now preserves structured rule metadata on notes instead of relying on body parsing alone. This adds a typed
DetectionMetaextension toMemoryNote.metadataand populates it for Sigma and YARA writes so downstream consumers can query detection fields directly.Related issue
This change addresses the follow-up for typed detection metadata support in Sigma/YARA ingest.
Changes
DetectionMetadataclass to the note schema and exposed it onMemoryNote.metadata.detection.MemoryManager.remember(...)so detection metadata is carried all the way into persisted notes.DetectionMetaduring Sigma ingest with logsource facets, rule level/status, references, false positives, and fields.DetectionMetaduring YARA ingest with CCCS tier, source path, MITRE ATT techniques, category, technique, author, fingerprint, and sample hashes.Testing
pytest tests/ -v)ruff check src/zettelforge/)