docs: cara pública de cierre del proyecto (arXiv v25) - #137
Conversation
- README.md: reescrito para quien llega del paper (arXiv:2604.04952 v25). reproduce-paper en portada; enlaces a la doc generada (Pages) y a la guía de drivers; puntero a paper-artifacts/; F1=0.9985 anclado al subconjunto conductual de 646; artefacto de investigación, no producción. - Makefile: up/halt -> 5 VMs (up-argus/halt-argus siguen como alias de 2); reproduce-paper (composición de 7 targets ya validados) + reproduce-paper-deps (construye correlation-engine + adapters suri/zeek -> from-scratch honesto por construcción); mitre-dataset; custom-start DRIVER=...; validate-driver. - scripts/custom_start.sh.template + docs/WRITING-A-DRIVER.md: andamio "escribe tu ataque, recibe tu dataset" (DEBT-DATASET-DRIVER-CONTRACT-001 nivel 3: el investigador rellena solo el SEAM). - paper-artifacts/: salidas exactas del run anclado 20260804-080140 (bias-report, bias-denominator-true, dataset modo A) para revisar sin correr. - docs/HITOS.md: diario DAY 111-252 archivado (poda Vía Appia del README).
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThe PR adds VM and dataset reproduction commands, a validated custom traffic-driver workflow, paper-supporting reports, and a rewritten research-artifact README with historical and driver documentation. ChangesReproducibility and research artifact workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Researcher
participant Makefile
participant custom_start.sh.template
participant Sensors
participant Kuzu
Researcher->>Makefile: Run reproduce-paper or custom-start
Makefile->>custom_start.sh.template: Execute validated driver
custom_start.sh.template->>Sensors: Start, drain, and collect sensor data
Sensors->>custom_start.sh.template: Return sensor artifacts
custom_start.sh.template->>Kuzu: Load datasets and create correlations
Kuzu->>custom_start.sh.template: Return graph and verdict results
custom_start.sh.template->>Researcher: Print validation output
Possibly related PRs
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Looks safe to merge — no coupling regressions and no blocking issues, checked against the code graph (not a self-assessment).
Graphify review — findings
This pull request appears to reframe the project's public-facing documentation and add reproducibility tooling. In the Makefile, it changes up/halt to bring up/down a broader set of VMs (defender, client, suricata, zeek, wazuh) instead of just the argus targets, and adds new targets under a "DAY 254" section: reproduce-paper (which composes existing fetch/export/report targets), mitre-dataset, custom-start (runs a user-supplied driver script), reproduce-paper-deps, and validate-driver (checks for expected parquet/Kuzu artifacts). The README.md is substantially rewritten, replacing a large collection of status badges and milestone/hito sections with a shorter description positioning the project as a research artifact rather than a production system. The touched symbols also indicate corresponding rewrites/additions across docs (milestone history, "writing a driver" guide, paper-artifacts readme). The surface area spans build/orchestration configuration and documentation; I have not assessed whether the new Makefile targets or documented reproduction steps behave as intended.
No blocking issues surfaced. 2 lower-confidence candidates did not survive cross-model review.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 48 functions depend on the 48 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 48 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 48 function(s) in the blast radius were not formally verified this run
1 participant
Cara pública de cierre (arXiv:2604.04952 v25)
Cuarto y (probablemente) último PR antes de repo read-only. Cierra la cara
pública del entregable (1) del criterio de cierre: un README para quien llega
del paper + reproducibilidad como propiedad del repo.
Qué entra
make reproduce-paperen portada, enlaces a Pages y a la guía de drivers,puntero a
paper-artifacts/. F1=0.9985 anclado al subconjunto conductual de 646.up/halt-> 5 VMs (alias de 2 conservados);reproduce-paper(composición de 7 targets ya validados) +
reproduce-paper-deps(construyecorrelation-engine + adapters suri/zeek para que el from-scratch sea honesto
por construcción);
mitre-dataset,custom-start,validate-driver.scripts/custom_start.sh.template+docs/WRITING-A-DRIVER.md): salda DEBT-DATASET-DRIVER-CONTRACT-001 nivel 3 —el investigador rellena solo el SEAM; el harness invariante hace el resto.
20260804-080140para revisarsin correr nada.
Honesto / diferido
destroy -f && up-> bootstrap ->reproduce-paper, ~2h) queda diferido a la promoción a EMECAS+++. Los targets
están verificados por
make -n(composición) y sus piezas ya corrieron en díasprevios; falta la corrida limpia end-to-end desde clon, que es ese test.
propio PR, no aquí.
reproduce-paperreconstruye deps en cada corrida (cierre de dependenciascompleto); afinar la velocidad es future-work.
Summary by CodeRabbit
New Features
Documentation