Files
rengine/shared/definitions/correlation.py
T
Yogesh OjhaandClaude Opus 5 2cb8d73280 style: strip explanatory comments across the codebase
The comment rule in CLAUDE.md is one line maximum, never narration: no
multi-line blocks, no module-header explainers, no sentences that explain or
justify the code to the reader. The tree had drifted a long way from it, and
most of the drift is mine.

Removed:
  232  lines of multi-line comment blocks
  203  single-line comments that argued instead of stating
  154  comments joined by so/because/otherwise/rather-than
  143  narrating comments in the frontend
  112  test docstrings (the test name already says what it asserts)
   25  test module docstrings and 25 decorative section dividers

Collapsed:
  324  multi-line docstrings to one factual line
  271  one-line docstrings that had a justifying clause bolted on

Kept: functional directives, section dividers, short field labels, alembic
revision headers, and the eight FastAPI route docstrings that render in /docs.
Where a fact was load-bearing it is in CLAUDE.md, which is where it belongs.

284 python tests and 34 frontend tests pass, ruff and ruff-format clean across
ten packages, svelte-check 0 errors, prettier and eslint clean, app.main imports.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013dKUV96WkQQETZBMoAG98C
2026-09-11 14:11:23 +05:30

74 lines
2.6 KiB
Python

"""Identity kinds two hosts can share, and the thresholds that make a shared identity significant."""
from __future__ import annotations
from enum import StrEnum
MAX_GRAPH_HOSTS = 3000
MAX_HUBS_PER_KIND = 80
MIN_SHARED = 2
# hidden by default at or above this share
COMMON_SHARE = 0.5
MIN_ESTATE_FOR_COMMON = 25
class CorrelationKind(StrEnum):
IP = "ip"
CNAME = "cname"
TITLE = "title"
FAVICON = "favicon"
BODY = "content_hash"
JARM = "jarm"
CERT = "cert.fingerprint"
CERT_ISSUER = "cert.issuer"
HEADERS = "header_hash"
TECH = "tech"
SERVER = "server"
CDN = "cdn"
CORRELATION_KIND_LABELS: dict[str, str] = {
CorrelationKind.IP.value: "Address",
CorrelationKind.CNAME.value: "CNAME target",
CorrelationKind.TITLE.value: "Page title",
CorrelationKind.FAVICON.value: "Favicon",
CorrelationKind.BODY.value: "Body hash",
CorrelationKind.JARM.value: "TLS fingerprint",
CorrelationKind.CERT.value: "Certificate",
CorrelationKind.CERT_ISSUER.value: "Certificate issuer",
CorrelationKind.HEADERS.value: "Header set",
CorrelationKind.TECH.value: "Technology",
CorrelationKind.SERVER.value: "Server header",
CorrelationKind.CDN.value: "CDN",
}
CORRELATION_KIND_HELP: dict[str, str] = {
CorrelationKind.IP.value: "Hosts resolving to the same IP address",
CorrelationKind.CNAME.value: "Hosts aliased to the same CNAME target",
CorrelationKind.TITLE.value: "Hosts responding with the same page title",
CorrelationKind.FAVICON.value: "Hosts serving the same favicon hash",
CorrelationKind.BODY.value: "Hosts returning an identical response body",
CorrelationKind.JARM.value: "Hosts with the same JARM TLS fingerprint",
CorrelationKind.CERT.value: "Hosts presenting the same certificate",
CorrelationKind.CERT_ISSUER.value: "Hosts presenting certificates from the same issuer",
CorrelationKind.HEADERS.value: "Hosts returning an identical set of response headers",
CorrelationKind.TECH.value: "Hosts fingerprinted with the same technology",
CorrelationKind.SERVER.value: "Hosts returning the same Server header",
CorrelationKind.CDN.value: "Hosts fronted by the same CDN or WAF",
}
# drawn by default
CORRELATION_DEFAULT_KINDS: frozenset[str] = frozenset(
{
CorrelationKind.IP.value,
CorrelationKind.CNAME.value,
CorrelationKind.TITLE.value,
CorrelationKind.FAVICON.value,
CorrelationKind.BODY.value,
CorrelationKind.JARM.value,
CorrelationKind.CERT.value,
}
)
CORRELATION_KIND_ORDER: tuple[str, ...] = tuple(k.value for k in CorrelationKind)