Verified defect
Fresh review of the MISP adapter found a separate interoperability defect in src/misp_import.rs::severity_from_event. MISP's canonical threat_level_id semantics are 1 = High, 2 = Medium, 3 = Low, 4 = Undefined, while Wardnet's inherited translation mapped the defined levels one tier too strongly (1 -> Critical, 2 -> High, 3 -> Medium). That inflated source severity and could distort SOC evidence, alert prioritization, policy decisions and downstream provenance.
This is distinct from #168's to_ids/lifecycle admission repair and from #172's shared DNSBL snapshot ownership. It is an adapter/ACL translation defect: externally supplied source severity must not be silently promoted beyond the producer's asserted semantics.
TDD acceptance
RED:
- otherwise admissible MISP events/attributes with
threat_level_id 1, 2 and 3 must produce exactly Wardnet High, Medium and Low;
- string and numeric source spellings accepted by the existing parser remain covered;
- the inherited
Critical/High/Medium behavior must fail those assertions.
GREEN:
Current owning candidate — 2026-09-06 KST
PR #170 is the bounded child owner at exact 7b383859257d2f317e0c40f68b3d8d706628ad9d, Draft. RED 45c5c2d0fc87cf6897eabaed032231fb589185e8 captured the inflated mapping before production change; GREEN 1502edf1cff801b1e4d31dfab1d4a0aad89ef489 implements 1 -> High, 2 -> Medium, 3 -> Low; subsequent documentation/tests retain compatibility behavior for 4 = Undefined, missing and unrecognized values.
The child last non-force adopted parent #167 through exact 28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98 by an ordinary two-parent merge. Its unique severity delta remains only src/misp_import.rs, tests/misp_threat_level_severity.rs, and docs/doctoring/misp-threat-level-severity.md; no shared DNSBL reconciliation implementation is duplicated.
Live parent #167 has since advanced linearly to 340f20b1898099bbf2b58a2a2cbd34c8f6057b35 with a one-line correction to the predecessor-state DNSBL ownership RED. GitHub therefore correctly reports #170 non-mergeable against its recorded parent. Do not churn/restack #170 solely for that transient parent test correction while #167 still lacks the shared DNSBL production GREEN. Once #167 reaches its causal shared-reconciler GREEN on a stable exact head, re-read every intervening parent delta and non-force adopt the complete parent lineage in one repair, then reacquire all child exact-head evidence. No parent RED/check/review evidence transfers.
Keep #170 Draft until #167/#172's shared production reconciliation reaches causal GREEN and #167 becomes protected truth or is fully superseded. Then non-force adopt fresh protected ancestry and reacquire every exact-current CI/Fuzz/security/SAST/CodeQL/review/governance gate. No predecessor evidence transfer, self/model approval, routine bypass, force push, destructive rebase, gate weakening or no-op redispatch churn.
Verified defect
Fresh review of the MISP adapter found a separate interoperability defect in
src/misp_import.rs::severity_from_event. MISP's canonicalthreat_level_idsemantics are1 = High,2 = Medium,3 = Low,4 = Undefined, while Wardnet's inherited translation mapped the defined levels one tier too strongly (1 -> Critical,2 -> High,3 -> Medium). That inflated source severity and could distort SOC evidence, alert prioritization, policy decisions and downstream provenance.This is distinct from #168's
to_ids/lifecycle admission repair and from #172's shared DNSBL snapshot ownership. It is an adapter/ACL translation defect: externally supplied source severity must not be silently promoted beyond the producer's asserted semantics.TDD acceptance
RED:
threat_level_id1, 2 and 3 must produce exactly WardnetHigh,MediumandLow;Critical/High/Mediumbehavior must fail those assertions.GREEN:
1 -> High,2 -> Medium,3 -> Low;4 = Undefinedand missing/unrecognized values without inventing higher source confidence;to_idsor deletion-state gates;Current owning candidate — 2026-09-06 KST
PR #170 is the bounded child owner at exact
7b383859257d2f317e0c40f68b3d8d706628ad9d, Draft. RED45c5c2d0fc87cf6897eabaed032231fb589185e8captured the inflated mapping before production change; GREEN1502edf1cff801b1e4d31dfab1d4a0aad89ef489implements1 -> High,2 -> Medium,3 -> Low; subsequent documentation/tests retain compatibility behavior for4 = Undefined, missing and unrecognized values.The child last non-force adopted parent #167 through exact
28d0ac12d37b4c97ea58b2d55831a6c1e7b9cf98by an ordinary two-parent merge. Its unique severity delta remains onlysrc/misp_import.rs,tests/misp_threat_level_severity.rs, anddocs/doctoring/misp-threat-level-severity.md; no shared DNSBL reconciliation implementation is duplicated.Live parent #167 has since advanced linearly to
340f20b1898099bbf2b58a2a2cbd34c8f6057b35with a one-line correction to the predecessor-state DNSBL ownership RED. GitHub therefore correctly reports #170 non-mergeable against its recorded parent. Do not churn/restack #170 solely for that transient parent test correction while #167 still lacks the shared DNSBL production GREEN. Once #167 reaches its causal shared-reconciler GREEN on a stable exact head, re-read every intervening parent delta and non-force adopt the complete parent lineage in one repair, then reacquire all child exact-head evidence. No parent RED/check/review evidence transfers.Keep #170 Draft until #167/#172's shared production reconciliation reaches causal GREEN and #167 becomes protected truth or is fully superseded. Then non-force adopt fresh protected ancestry and reacquire every exact-current CI/Fuzz/security/SAST/CodeQL/review/governance gate. No predecessor evidence transfer, self/model approval, routine bypass, force push, destructive rebase, gate weakening or no-op redispatch churn.