correlate: member-aware static-event matching + GTD runtime-only → confirmed acceptance (#278 loop closed)

[PhysShell]

Closes the collector-plan step-7 follow-up: type identity alone no longer transfers a runtime root onto unrelated event findings of the same class.

Contract (runtime/correlate.py): a subscription-leak finding facing a retention with identified static-event roots confirms only when its canonical event identity (event ''A.B.Holder.Member'') equals a root''s (short(holder), member) key; the matched root is reported (message + root_holder/root_member). Unparseable identity is conservative (static-only, retention may surface runtime-only). Non-event categories and identity-less retentions keep the type-level fallback, byte-for-byte.

RED: runtime/tests/test_member_aware.py (10 cases: aliasing, holder-tail mismatch, namespace normalization, matched-root selection, fallback, conservatism, non-event invariance, synthetic GTD transition) + committed fixtures runtime/fixtures/gtd-transition-{pre,post,runtime}.json. Existing synthetic tests updated to carry consistent event identities.

ACCEPTANCE (real STS, one fresh heap artifact × three Own.NET snapshots — the analyzer is the only variable):

Snapshot	Own.NET SHA	GTD verdict
pre-#278	366bbf9…	runtime-only (blind spot, root named GBProperty.PropertyChanged); 0 false confirmed against GTD.cs
exact #278 (PR #293)	a7d8499…	confirmed high at exactly GTD.cs:5192
current main (#302)	2c30c56…	identical — no late drift

KDT (KDT.cs:60/61 — the :88 site under dsector line numbers) stays confirmed via the unchanged fallback. Full artifact hashes, commands and excerpts: docs/evidence/gtd-runtime-transition.md.

Suites: 15/15 runtime, 10/10 member-aware (+ -O), 6/6 oracle, downstream report/dashboard suites green. Out of scope untouched: Own.NET, collector/classifier, schema version, dashboard/exec, gate policy.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MigRSeRnzZH6fo3TP9fRET

Summary by CodeRabbit

• Bug Fixes

  • Improved subscription-leak correlation by matching findings to the specific static event and member involved.
  • Prevented unrelated or ambiguous event findings from being incorrectly confirmed.
  • Preserved existing type-level matching for categories without event-specific identity.

• Documentation

  • Added runtime correlation guidance and evidence for the GTD transition from runtime-only to confirmed.

• Tests

  • Added comprehensive regression coverage for member-aware matching, conservative fallback behavior, and GTD transition scenarios.

[coderabbitai]

📝 Walkthrough

Walkthrough

The correlator now performs member-aware matching for subscription-leak findings, adds GTD transition fixtures and regression tests, documents the runtime contract and evidence, and runs the new tests in CI and the documented regression sweep.

Changes

Member-aware correlation

Layer / File(s)	Summary
Correlation contract and implementation runtime/correlate.py, docs/runtime-contract.md	Subscription findings are matched to static-event roots by canonical holder/member identity, with conservative fallback and root-specific confirmation fields.
Transition fixtures and regression coverage runtime/fixtures/*, runtime/tests/test_member_aware.py, runtime/tests/test_runtime.py	GTD pre/post transition fixtures and tests cover matching, fallback, root selection, conservative handling, and existing correlation behavior.
Evidence and execution wiring docs/evidence/*, docs/collector-plan.md, AGENTS.md, .github/workflows/ci.yml	Evidence and acceptance documentation record the transition, while CI and regression guidance execute the member-aware test module normally and under -O.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant StaticFinding
  participant correlate
  participant RuntimeDump
  participant ConfirmedOutput
  StaticFinding->>correlate: submit subscription event identity
  correlate->>RuntimeDump: inspect retained static-event roots
  RuntimeDump-->>correlate: return holder/member roots
  correlate->>ConfirmedOutput: classify and report matching root

Loading

Possibly related PRs

• PhysShell/OwnAudit#9: Related CI test-job and -O rerun workflow structure.
• PhysShell/OwnAudit#13: Related runtime subscription-leak correlation behavior and test coverage.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: member-aware static-event correlation and the GTD transition from runtime-only to confirmed.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/member-aware-correlation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[PhysShell]

Independent review verdict — APPROVED, no blocking findings.

Verified on exact head 8825b38: member-aware matching applies only to subscription findings with identified static-event roots; unmatched or unparseable identities remain conservative; non-event and identity-less fallback is preserved; matched-root provenance is emitted; synthetic and real three-snapshot evidence closes the GTD runtime-only → confirmed transition at exactly GTD.cs:5192; scope is clean and CI is green.

[coderabbitai]

🧹 Nitpick comments (1)

docs/evidence/gtd-runtime-transition.md (1)

80-84: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add language identifiers to fenced code blocks.

Both code blocks are missing language identifiers, which triggers markdown linting rules (MD040). Consider adding text to these blocks.

• docs/evidence/gtd-runtime-transition.md#L80-L84: Change ``` to ```text.
• docs/evidence/gtd-runtime-transition.md#L88-L93: Change ``` to ```text.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/evidence/gtd-runtime-transition.md` around lines 80 - 84, Add the text
language identifier to both fenced code blocks in
docs/evidence/gtd-runtime-transition.md: lines 80-84 and 88-93. Change each
opening fence from ``` to ```text to satisfy markdown linting.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/evidence/gtd-runtime-transition.md`:
- Around line 80-84: Add the text language identifier to both fenced code blocks
in docs/evidence/gtd-runtime-transition.md: lines 80-84 and 88-93. Change each
opening fence from ``` to ```text to satisfy markdown linting.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f9385f05-5bf0-4ac8-8998-edf6e43eb08b

📥 Commits

Reviewing files that changed from the base of the PR and between d43f575 and 8825b38.

📒 Files selected for processing (11)

• .github/workflows/ci.yml
• AGENTS.md
• docs/collector-plan.md
• docs/evidence/gtd-runtime-transition.md
• docs/runtime-contract.md
• runtime/correlate.py
• runtime/fixtures/gtd-transition-post.json
• runtime/fixtures/gtd-transition-pre.json
• runtime/fixtures/gtd-transition-runtime.json
• runtime/tests/test_member_aware.py
• runtime/tests/test_runtime.py