fix(report): one canonical Severity, one severity vocabulary, issen-owned anomaly codes

[h4x0r]

Three report-layer DRY defects, fixed under strict TDD: RED commit 76a0109 (failing tests only), GREEN commit 499b055 (implementation).

Defect 1 — two Severity clones

Both were checked against the possibility of being a genuinely different scale (as srum-analysis's Clean/Informational/Suspicious/Critical legitimately is, normalizing at its boundary per ADR-0007). Neither is — both are the canonical five-tier scale, so both migrate to forensicnomicon::report::Severity rather than converting at a boundary.

Clone	Verdict
issen-signatures::matching::results::Severity	Pure duplicate. Informational is the canonical Info renamed; plus a private from_str_lossy and a private lowercase Display.
forensic-pivot::rule::Severity	Pure duplicate. Identical variant set, declared highest-first, deriving only PartialEq — so pivot findings could not be ranked at all. Now gains Ord and Display.

The // RED: stub — types declared but no real logic header on rule.rs was stale; that crate has real logic and is wired into issen pivot.

#[non_exhaustive] forces _ arms in issen-navigator (tree marker, severity colour), its alert mapper, and issen-cli's pivot table. Each escalates rather than silently downgrading an unknown future tier.

Defect 2 — severity_rank / severity_token triplicated

Interim fix, issen-side only — as instructed, no competing forensicnomicon PR was opened. New issen_core::severity holds the one definition: SeverityExt::{rank, token}, parse, parse_lossy, TOKENS. It is deliberately a trait, so when forensicnomicon grows inherent Severity::rank()/token() those shadow it and this module becomes a pure deletion with zero call-site churn.

Five copies collapse onto it — the two named in the task, plus three more found while tracing: severity_from_finding_str, navigator_output::severity_of, and Severity::from_str_lossy.

Two drifts the copies had already shipped, now fixed:

• render_html emitted class="severity-info" while the stylesheet only defined .severity-informational — the Info tier rendered unstyled.
• Correlation::severity_from_str parsed case-sensitively while issen-report's copy was case-insensitive, and issen-disk writes a capitalised "High" into event metadata.

The bottom-tier token moves "informational" → "info". "informational" stays accepted on every read path (--min-severity, the scan_findings query filter, the report parser), so pre-existing case DBs and invocations keep working. issen_timeline::query_findings no longer hardcodes its own level ladder.

Defect 3 — NTFS- encroachment

The two timestomp codes do not describe the same detection. Both implementations were read:

	ntfs-forensic NTFS-TIMESTOMP	issen NTFS-TIMESTOMP-SI-FN-MISMATCH
Input	parsed $STANDARD_INFORMATION + $FILE_NAME attributes	TimelineEvent metadata
Ordering signal	strict $SI.created < $FN.created	same, plus $SI.modified, plus a clock-skew tolerance
Sub-second tell	any whole-second $SI stamp, unconditional	requires the contrast: $SI zeroed while $FN retains 100 ns precision
Benign modifiers	none	copy / volume-move / high-FP path, each downgrading
Grade	always High	Info–Medium, capped at Medium by design

So consolidating onto NTFS-TIMESTOMP would make an Info-tier lead indistinguishable from a High-tier filesystem anomaly — losing the distinction issen's precision-first redesign exists to make. They stay distinct codes.

The real defect is the namespace. ntfs-forensic owns NTFS- and already ships six codes there (NTFS-TIMESTOMP, NTFS-ADS, NTFS-DELETED-RECORD, NTFS-SLACK-RESIDUE, NTFS-MFTMIRR-MISMATCH, NTFS-LOGFILE-CLEARED). issen consumes those codes, which makes it exactly the crate that must not also mint into the namespace — and the old string was a strict prefix-extension of a shipped code, so prefix grouping conflated the two.

NTFS-TIMESTOMP-SI-FN-MISMATCH  ->  HEUR-TIMESTOMP-SI-FN
NTFS-BOOT-BACKUP-MISMATCH      ->  HEUR-BOOT-BACKUP-MISMATCH

HEUR- is issen's own detection-layer prefix — 18 existing codes spanning timestomping, location, entropy, size, magic and USN. Both are now named constants (TIMESTOMP_CODE, issen_disk::BOOT_BACKUP_CODE), asserted through the constant rather than a literal, so they cannot drift again.

These are consumer-visible contract changes. The Case-001 Szechuan answers doc is updated in the same commit.

Gate

Check	Result
cargo build --workspace	clean
cargo test (9 affected crates)	1887 passed, 0 failed, 8 ignored
cargo clippy --workspace --all-targets -- -D warnings	clean
cargo fmt --check	clean

One workspace test fails both on this branch and on origin/main: issen-mem dispatch::tests::dispatch_windows_netstat_returns_ok. Verified against main directly; unrelated to this change and untouched by it.

Follow-ups (cross-repo, not done here)

1. forensicnomicon — add inherent Severity::rank() and Severity::token(). issen_core::severity::SeverityExt is shaped so those shadow it and the interim module deletes cleanly. Deferred because forensicnomicon PR #24 is open this session.
2. ntfs-forensic — the $Boot-vs-backup integrity check belongs in its ArtifactAnomaly family beside the $MFTMirr one (ADR-0016 puts filesystem-structure checks in the FILESYSTEM layer). Once there, the crate legitimately owns an NTFS--prefixed code for it. Noted in BOOT_BACKUP_CODE's doc comment.
3. issen, separate change — issen-signatures' HEUR-TS-002 ($SI/$FN divergence > 24 h) and HEUR-TS-003 ($SI sub-seconds zeroed while $FN retains precision) overlap the correlation-layer detector's S1/S3 signals. A third timestomp implementation, out of scope here.

🤖 Generated with Claude Code