fix(misp): preserve source threat-level severity

[seonghobae]

Verified integration defect

Closes #169 only when the severity delta reaches protected main on current parent ancestry.

This remains a bounded child of #167. MISP's canonical threat_level_id enum is 1 = High, 2 = Medium, 3 = Low, 4 = Undefined, while the inherited Wardnet adapter translated defined source levels one tier too strongly. The child preserves source authority semantics without changing #167's affirmative to_ids, active-lifecycle admission, or shared DNSBL snapshot-ownership boundary.

Retained RED → GREEN

• RED 45c5c2d0fc87cf6897eabaed032231fb589185e8 proves inherited 1/2/3 -> Critical/High/Medium violates source semantics;
• GREEN 1502edf1cff801b1e4d31dfab1d4a0aad89ef489 maps 1 -> High, 2 -> Medium, 3 -> Low;
• MISP 4 = Undefined remains represented as Wardnet Low because the current Wardnet enum has no Undefined member; missing/unrecognized source level retains the documented compatibility fallback to Medium;
• 20394e75fc175472db3c7deaac01572750894a79 and 2768ecf71d8527fe02a568ce4575754e71378813 retain primary-source traceability and undefined/missing compatibility tests.

The child does not duplicate parent DNSBL reconciliation. Fresh compare against parent exact 0c83cd5956f512d79c6600e823fcfa6d6f32af4e proves its effective delta is exactly three files: docs/doctoring/misp-threat-level-severity.md, src/misp_import.rs, and tests/misp_threat_level_severity.rs.

Stable parent adoption — 2026-09-06 KST

Parent #167 reached causal DNSBL source GREEN at 7042aa19267886e3af9c378dddd879929837877b, resolved its valid ownership review thread, non-force adopted protected main@a52ccd0a24a727d9349bb32def7713882d8cad1e, and remains exact 0c83cd5956f512d79c6600e823fcfa6d6f32af4e.

The first child restack attempt 34001023594 acquired macos-15-arm64 and exposed a real child formatting defect after the parent merge. Workflow repair 0912d5bc9490f65daa0b1a22b2bd3df26b2b5f41 changed the restack to format under the pinned Rust toolchain and asserted that only the two expected severity code/test files required formatting.

Causal restack run 34001140916 then completed GREEN. It pinned both child and parent refs, merged exact parent 0c83cd5... without rewriting history, formatted only the expected child files, ran full cargo test --locked --workspace and strict workspace Clippy successfully, removed the temporary restack workflow, proved the child-versus-parent delta is exactly the three severity files, and non-force pushed two-parent merge e0a7d9034b8810fc4284beb57f990eb2c3ab7641.

Current exact child head remains human-authored doctoring commit 2c8d499a5772b0be64d7cc3fc42ed2825ba1499e, which records that integration evidence without changing runtime semantics. The PR base SHA is exactly parent 0c83cd5...; no temporary workflow remains in the child tree.

Exact-current execution

The earlier queued state is superseded. On unchanged exact 2c8d499..., child CI 34001236320 and Fuzz 34001236319 have both reached terminal SUCCESS. These prove the child on its current stacked parent only; they do not transfer across the required future parent protected-merge/retarget/restack.

Parent #167 itself now has exact-current CI/Fuzz/Security/Semgrep GREEN but CodeQL remains fail-closed at the central delegated-verdict boundary. Therefore #167 is still Draft/non-integrated, and this child cannot be promoted to protected truth yet. When the parent eventually integrates, retarget/non-force restack this child onto fresh protected main, prove the same bounded three-file delta, and reacquire all then-live security/review/governance evidence.

Keep Draft. Parent source/test/check conclusions do not transfer as child final merge evidence. No self/model approval, gate weakening, routine or implicit administrator bypass, no-op redispatch, force push, destructive rebase, stale-parent merge, temporary-workflow inheritance, or predecessor-evidence promotion is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}