From PLAN.md step 5. Spec: docs/spec.md. Phase 1.
⟂ Parallel-safe — touches files no other concurrent step touches.
Files: src/flabel/zeek.py, data/json-logs.zeek, tests/test_zeek.py
Changes: Single invocation zeek -C -D -r <pcap> json-logs.zeek. The Zeek script adds JSON log filters for conn and ssl so one pass yields both TSV (retained) and JSON (parsed) and they cannot disagree. Parse conn_json.log into Flow, join ssl_json.log for ja4/ja4s/server_name on uid. Retain all TSV logs; strip the _json files from retained output.
Test that proves it: on benign.pcap, exactly two flows with the expected tuples. Determinism gate: two runs produce identical uids — this is the regression test for the verified spike-3 finding, and it fails if -D is ever dropped. packet_filter.log is confirmed non-reproducible and excluded. A TLS fixture yields a populated ja4. Non-zero exit produces a tool_failures[] entry rather than an exception escaping.
Depends on: 2. Parallel with: 3, 4, 6.
From
PLAN.mdstep 5. Spec:docs/spec.md. Phase 1.Files:
src/flabel/zeek.py,data/json-logs.zeek,tests/test_zeek.pyChanges: Single invocation
zeek -C -D -r <pcap> json-logs.zeek. The Zeek script adds JSON log filters forconnandsslso one pass yields both TSV (retained) and JSON (parsed) and they cannot disagree. Parseconn_json.logintoFlow, joinssl_json.logforja4/ja4s/server_nameonuid. Retain all TSV logs; strip the_jsonfiles from retained output.Test that proves it: on
benign.pcap, exactly two flows with the expected tuples. Determinism gate: two runs produce identicaluids — this is the regression test for the verified spike-3 finding, and it fails if-Dis ever dropped.packet_filter.logis confirmed non-reproducible and excluded. A TLS fixture yields a populatedja4. Non-zero exit produces atool_failures[]entry rather than an exception escaping.Depends on: 2. Parallel with: 3, 4, 6.