From PLAN.md step 1. Spec: docs/spec.md. Phase 1.
Files: .github/workflows/ci.yml, Dockerfile.toolchain (or a CI install block), docs/dev-setup.md, .gitignore
Changes: Provide pinned Zeek 6+/8.x, Suricata 8.x, and Wireshark (editcap, capinfos) to CI, plus the zeek/foxio/ja4 package via zkg. Record exact versions — pinning is a precondition for Goal 2, since reproducibility across unpinned tool versions is meaningless. Document local setup (brew install zeek suricata wireshark). Add .flabel/ to .gitignore.
Test that proves it: CI runs a job asserting zeek --version, suricata --version, editcap --version all succeed and match the pinned versions, then runs pytest -q. CI fails if zero requires_tools tests executed — a skipped integration suite must never look like a passing one.
Depends on: nothing. Blocks: everything.
From
PLAN.mdstep 1. Spec:docs/spec.md. Phase 1.Files:
.github/workflows/ci.yml,Dockerfile.toolchain(or a CI install block),docs/dev-setup.md,.gitignoreChanges: Provide pinned Zeek 6+/8.x, Suricata 8.x, and Wireshark (
editcap,capinfos) to CI, plus thezeek/foxio/ja4package viazkg. Record exact versions — pinning is a precondition for Goal 2, since reproducibility across unpinned tool versions is meaningless. Document local setup (brew install zeek suricata wireshark). Add.flabel/to.gitignore.Test that proves it: CI runs a job asserting
zeek --version,suricata --version,editcap --versionall succeed and match the pinned versions, then runspytest -q. CI fails if zerorequires_toolstests executed — a skipped integration suite must never look like a passing one.Depends on: nothing. Blocks: everything.