dborupandClaude Sonnet 5 d9d3883a53 fix: anomaly detection matched a bare "MM:" prefix, but text is sender-prefixed ...

decodeGrpTxt (cmd/ingestor/decoder.go) builds decoded_json.text as
"<sender>: <message>", so a wardriving message's real text is
"<sender>: MM:<base64>", not a bare "MM:<base64>" at the start of the
string. detectWardrivingAnomalies's HasPrefix(text, "MM:") check never
matched anything live, silently returning standardPayloadCount=0 and
no anomalies — caught after deploying idea 6 to stg and seeing 0/0
against traffic that should have had ~160 standard-format messages.
Fixed to match the exact "<sender>: MM:" prefix. The Go test fixtures
shared the same wrong assumption and are fixed too.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-20 15:28:01 +02:00

..

decrypt

feat: CLI tool to decrypt and export hashtag channel messages (#724)

2026-04-12 22:07:41 -07:00

ingestor

fix: address remaining bot-review findings on PR #1852

2026-07-18 19:02:20 +02:00

migrate

refactor(db): finish #1283 — Option 4: ingestor owns neighbor-graph + schema migrations; server is read-only (fixes #1287) (#1289)

2026-05-19 23:53:41 -07:00

server

fix: anomaly detection matched a bare "MM:" prefix, but text is sender-prefixed

2026-07-20 15:28:01 +02:00