diff --git a/src/Server.py b/src/Server.py index dd83285..f6ea7fa 100644 --- a/src/Server.py +++ b/src/Server.py @@ -183,6 +183,9 @@ def process_ingested_logs(payload: Dict[str, Any], db_path: str, window_hours: i if severity in ["DEBUG", "TRACE"]: continue + # Errors are always passed immediately; the 4-run rule only concerns warnings + is_error = severity in ["ERROR", "CRITICAL", "FATAL"] + signature = log.get("signature", "unknown") server = log.get("server", client_server) message = log.get("message", "") @@ -207,7 +210,7 @@ def process_ingested_logs(payload: Dict[str, Any], db_path: str, window_hours: i # Window elapsed: reset to new cycle new_runs = 1 new_first_seen = now_iso - new_status = "TRANSIENT" + new_status = "VERIFIED" if is_error else "TRANSIENT" else: # Same run guard: only increment count once per distinct run batch if last_run_id != run_id: @@ -215,8 +218,8 @@ def process_ingested_logs(payload: Dict[str, Any], db_path: str, window_hours: i else: new_runs = run_count new_first_seen = first_seen_str - # 4-run rule enforcement - new_status = "VERIFIED" if new_runs >= min_runs else "TRANSIENT" + # 4-run rule applies to warnings; errors are always passed immediately as VERIFIED + new_status = "VERIFIED" if (is_error or new_runs >= min_runs) else "TRANSIENT" if new_status == "VERIFIED" and current_status != "VERIFIED": promoted_to_verified += 1 @@ -227,7 +230,9 @@ def process_ingested_logs(payload: Dict[str, Any], db_path: str, window_hours: i WHERE fingerprint = ? """, (new_runs, now_iso, new_first_seen, new_status, run_id, message, severity, fp)) else: - initial_status = "VERIFIED" if 1 >= min_runs else "TRANSIENT" + initial_status = "VERIFIED" if (is_error or 1 >= min_runs) else "TRANSIENT" + if initial_status == "VERIFIED": + promoted_to_verified += 1 cursor.execute(""" INSERT INTO active_issues (fingerprint, site_name, server, signature, severity, message, os_type, first_seen, last_seen, run_count, status, last_run_id) @@ -328,8 +333,8 @@ def get_hermes_report(): cursor.execute(""" SELECT fingerprint, site_name, server, signature, severity, message, os_type, first_seen, last_seen, run_count, status FROM active_issues - WHERE status = 'VERIFIED' AND run_count >= ? - """, (min_runs,)) + WHERE status = 'VERIFIED' + """) rows = cursor.fetchall() conn.close() @@ -452,7 +457,7 @@ def main(): print("=" * 60) print(f" LOGAR Server Hub: {config['server_name']}") print(f" Encryption Fingerprint: {config['server_fingerprint']}") - print(f" Evaluation Window: {config['evaluation_window_hours']} hours | Rule: {config['min_persistence_runs']}+ consecutive runs") + print(f" Evaluation Window: {config['evaluation_window_hours']} hours | 4-Run Rule: Warnings | Immediate Pass: Errors") print("=" * 60) try: