fix: bind OOB findings to the probe callback token

[Ymax27]

Summary

• A blind out-of-band finding is promoted only when returned events have a string token equal to the probe token and a protocol of http or dns.
• query_events() applies that filter, and analyze_oob_header_probe() derives oob_confirmed from the validated events rather than bool(events).
• Stored callback evidence keeps token and protocol only, so source addresses and free-form detail are not persisted.
• Wrong-token, missing-token, malformed, unsupported-protocol, and mixed-event cases are covered. Matching HTTP and DNS callbacks still promote.

Scope

Fixes #36.

This does not weaken the gate to a warning. An unrelated callback cannot satisfy another probe, including when it is returned from /api/events/<expected-token>.

Validation

Commands run on this branch:

PYTHONPATH=src python3 -m pytest -q tests/test_oob.py

Observed result: 5 passed.

ruff and mypy are not installed in this environment, so those gates were not run. The detector/evidence coverage gate was also not run here.

Checklist

• CLI changes are safe by default and documented.
• New detection behavior includes tests.
• False-positive filtering remains conservative by default.
• Observations/probes are preserved even when findings are filtered.
• Evidence schema and proof-gate mutation tests pass.
• No destructive payloads or denial-of-service behavior were added.
• I reviewed the final diff and can explain the changes I am submitting.
• Validation results in this PR are from commands actually run on this branch; no results or evidence were fabricated.
• Any assumptions I could not verify are stated explicitly instead of being presented as facts.

Made with Cursor

[tayfuryldz]

The functional tests pass, but this branch still fails the repository Ruff gate. tests/test_oob.py has two unused imports: json and BaseHTTPRequestHandler. Please remove those and push the cleanup; I will re-run the full suite after that.

[Ymax27]

For sure I'm on it

[Ymax27]

Unnecessary imports removed

[tayfuryldz]

Thanks, the cleanup fixes the lint issue. I reran the branch against current main: Ruff and mypy are clean, the full test suite passes (122 passed, 3 skipped), and git diff --check is clean.

[Ymax27]

You're welcome.