mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 23:31:31 +02:00
Yogesh OjhaandClaude Opus 5
2bb9a61e1f
Every other correlation in the codebase filters for noise — origin exposure decays a fingerprint by its reach, the graph hides a hub carried by half the scan, rarity signals refuse to fire below a 25-host estate. The per-host relations on the asset sheet had only a cap, and a cap is not a filter. Two things were wrong on a real host. "Same network AS45353" listed 300 hosts because 300 is the cap; the network actually carries 7,163 of the scan's 24,028, and the sheet reported the cap as the truth. And a value carried by the entire estate — one CNAME in front of everything — was offered as a relation at all. SubdomainRelation now carries the real total beside the capped list, so the sheet reads "7,163 hosts sit in the same network" and shows the first 300 of them. A value on half the estate or more is dropped, reusing COMMON_SHARE from the correlation vocabulary rather than inventing a second threshold, and a scan below MIN_ESTATE_FOR_COMMON suppresses nothing because rarity has no meaning without a norm. The certificate relation went through its own hand-written query and now goes through the same gate as the rest. Four tests: a shared address is a relation, the count is the truth and not the length of the list, a value the whole estate shares is not a relation, and a small scan suppresses nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013dKUV96WkQQETZBMoAG98C