fix(sccm): map server intake artifact requests

[adamgell]

Scope

• Map server intake coverage requests from server group IDs to the exact shared catalog artifact selected by original basename plus producer role.
• Preserve producer-role provenance instead of relabeling site-server evidence as its workflow-subject role.
• Emit bounded artifact-specific reasons that pass shared finding build, serialization, and deserialization boundaries.
• Emit no shared request for unknown or non-CCM sources.
• Scope default-candidate suppression to the exact producer host and workflow-subject instance, so evidence from one topology identity cannot satisfy another.

Dependency state

PR #430 is merged into codex/parser-family-skeleton as 2d3c2b0e9ad21152ff76c5251066f7fb4e3b17b3; this PR is retargeted to that integration branch.

A Copilot coding-agent commit that touched unrelated #331/#332 fixture tests was independently inspected and reverted. Review-only Copilot was subsequently requested through the requested-reviewers API.

Refs #335
Epic #317

TDD evidence

Observed RED before implementation:

• absent DP emitted server-dp-distribution; SccmFindingBuilder rejected it as an undeclared artifact request;
• access-denied IIS evidence emitted a server-group request despite having no shared CCM catalog artifact;
• a captured source on one producer host suppressed a required absent-default request on another host;
• a captured source for one workflow subject suppressed a required request for another subject.

GREEN at exact head 46a7d06efd66cf989756c5a9989e896f78f70079:

• DP, MP, and SUP gaps use exact shared-catalog requests and survive finding JSON round trip;
• unknown and non-CCM sources emit no request;
• same-host/same-subject configured evidence suppresses its default candidate;
• distinct-host and distinct-subject candidates remain independent.

Verification

• focused server intake: 20/20 passed
• SCCM spine: 138/138 passed
• full cmtraceopen-parser: passed
• wasm32-unknown-unknown check: passed
• strict parser Clippy: passed
• changed-file rustfmt and git diff --check: passed
• CodeRabbit CLI exact committed comparison: 0 findings across both changed files
• Copilot exact-head review: 2/2 files, no new comments

Synthetic fixtures only. Native server discovery/capture and live Windows acceptance are not included or claimed; issue #335 remains open.

Summary by CodeRabbit

• Bug Fixes

  • Improved SCCM artifact-gap detection and request scoping.
  • Added support for matching artifacts across producer hosts and workflow subjects.
  • Standardized artifact names, roles, and diagnostic reasons in generated requests.
  • Prevented requests for unknown or unsupported artifact sources.

• Tests

  • Expanded coverage for request metadata, filtering, and finding serialization.
  • Updated distribution-point handling and cross-boundary validation.

[coderabbitai]

📝 Walkthrough

Walkthrough

SCCM server intake now classifies eligible incomplete artifacts and creates shared catalog requests. Tests cover request metadata, finding serialization, distribution-point identifiers, unsupported sources, and identity-scoped suppression.

Changes

SCCM artifact-gap requests

Layer / File(s)	Summary
Classify eligible artifact gaps crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs	The intake matches producer hosts and workflow subjects. It filters incomplete CCM artifacts by classification and derives the logical ID, role, and reason.
Validate request contracts and filtering crates/cmtraceopen-parser/tests/sccm_server_intake.rs	Tests validate shared catalog requests, finding round trips, the distmgr identifier, unsupported-source suppression, and identity-scoped default requests.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• adamgell/cmtraceopen#336: Introduces the artifact catalog API used by SCCM intake classification.
• adamgell/cmtraceopen#337: Defines role-aware artifact classification and SCCM server-intake behavior.
• adamgell/cmtraceopen#374: Updates SCCM distribution-point artifact handling and request scoping.

Suggested labels: test

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: mapping SCCM server intake artifact requests.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[adamgell]

@coderabbitai review

Please review exact head 850c82d0bbbd42ee7f264107d7821c8b344e0f92. This stacked #335 slice is limited to server intake artifact-request mapping and its focused tests.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

requested_head="850c82d0bbbd42ee7f264107d7821c8b344e0f92"
stack_base="4a330621fdb69303ba77d9137d4127a7ba628854"

echo "== checked-out commit =="
git rev-parse HEAD
echo "== requested commit =="
git rev-parse "$requested_head"
echo "== ancestry =="
git merge-base --is-ancestor "$stack_base" "$requested_head" && echo "base-is-ancestor=yes" || echo "base-is-ancestor=no"

echo "== changed paths, stack base..requested head =="
git diff --name-status "$stack_base" "$requested_head"
echo "== diff summary =="
git diff --stat "$stack_base" "$requested_head"

echo "== changed Rust file outlines =="
git diff --name-only "$stack_base" "$requested_head" -- '*.rs' |
while IFS= read -r file; do
  echo "--- $file"
  ast-grep outline "$file" --items all --view expanded || true
done

echo "== relevant contract symbols and test names =="
rg -n -C 3 -g '*.rs' \
  'UndeclaredArtifactRequest|ArtifactRequest|originalBasename|producer.role|producer_role|server_intake|sccm_server_intake' \
  .

Length of output: 213873

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="4a330621fdb69303ba77d9137d4127a7ba628854"
head="850c82d0bbbd42ee7f264107d7821c8b344e0f92"

echo "== exact diff =="
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
  crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs \
  crates/cmtraceopen-parser/tests/sccm_server_intake.rs

echo "== intake assessment request collection and request_for_gap =="
sed -n '200,305p' crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs
sed -n '860,930p' crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs

echo "== server source classification =="
sed -n '1,160p' crates/cmtraceopen-parser/src/sccm/server/windows/catalog.rs

echo "== shared catalog classifier and declared entries =="
rg -n -C 4 -g '*.rs' \
  'fn classify_artifact_name|pub fn classify_artifact_name|struct SccmArtifactClassification|declared_source_catalog' \
  crates/cmtraceopen-parser/src/sccm

Length of output: 40648

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== shared classifier implementation and relevant catalog entries =="
sed -n '401,460p' crates/cmtraceopen-parser/src/sccm/catalog.rs
rg -n -C 5 -i \
  'distmgr\.log|mp_getpolicy\.log|wsyncmgr\.log|mpcontrol\.log|smsdpprov\.log|pullDp' \
  crates/cmtraceopen-parser/src/sccm/catalog.rs

echo "== server intake fixture gap declarations =="
fd --type f --glob 'manifest.json' crates/cmtraceopen-parser/tests/fixtures/sccm/server/intake \
  --exec sh -c '
    for file do
      if grep -Eq "\"captureState\"[[:space:]]*:[[:space:]]*\"(absent|accessDenied|capped|parseFailed)\"" "$file"; then
        echo "--- $file"
        jq -r ".artifacts[] | select(.captureState == \"absent\" or .captureState == \"accessDenied\" or .captureState == \"capped\" or .captureState == \"parseFailed\") | [.artifactId, .sourceId, .sourceKind, .producerRole, (.workflowSubject.role // \"-\"), .originalBasename, .captureState] | `@tsv`" "$file"
      fi
    done
  ' sh {} +

echo "== request_for_gap references =="
rg -n -C 3 '\brequest_for_gap\s*\(' crates/cmtraceopen-parser/src crates/cmtraceopen-parser/tests

echo "== whitespace and working tree =="
git diff --check 4a330621fdb69303ba77d9137d4127a7ba628854 850c82d0bbbd42ee7f264107d7821c8b344e0f92
git status --short

Length of output: 6273

---

@adamgell Review complete for 850c82d0bbbd42ee7f264107d7821c8b344e0f92.

I found no actionable issues.

The change maps each coverage gap to the shared catalog artifact selected by originalBasename and producer role. It preserves producer-role provenance. It suppresses requests for unsupported, non-CCM, and unknown sources. The focused tests verify DP, MP, and SUP requests across finding build and JSON boundaries.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Copilot]

Pull request overview

This PR refines SCCM server-intake “coverage gap” artifact requests so they map from server-group coverage entries to the exact shared SCCM source-catalog artifact (selected by originalBasename + producer role), while preserving producer-role provenance and ensuring requests/reasons survive finding validation plus JSON serialization boundaries.

Changes:

• Update server-intake gap request generation to derive logical_id, role, and a bounded catalog-scoped reason from classify_artifact_name(...), and suppress requests for unknown/non-CCM sources.
• Add focused tests proving DP/MP/SUP gap requests now emit declared shared-catalog logical IDs and reasons that pass finding build + serialize/deserialize.
• Adjust existing DP absent-case expectation from server-group ID to the shared catalog logical name (distmgr).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
crates/cmtraceopen-parser/tests/sccm_server_intake.rs	Adds regression tests and a helper to ensure emitted next-artifact requests validate through finding + JSON boundaries; updates expected logical ID for DP absent case.
crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs	Reworks request_for_gap to emit catalog-declared artifact requests (logical name + producer role) with bounded per-artifact reasons and to suppress non-CCM/unknown requests.

[adamgell]

Independent root review at exact head 850c82d found no additional issue in the two-file feature diff. Focused server intake is 18/18 green in a clean detached review worktree.

I also overlaid blocked PR #404 with a no-commit merge to test the actual dependency boundary: the merge was conflict-free, server intake stayed 18/18, and the hardened spine suite was 151/151 green. The review worktree was then returned clean to exact 850c82d.

This is not a merge approval yet: PR #431 remains stacked on draft PR #430, exact-head Copilot completion and hosted checks are still pending, and neither PR is being treated as native Windows acceptance.

[adamgell]

Superseded: the dedicated requested-reviewers API is now being used for review-only. The coding-agent change prompted by the earlier mention was reverted because it touched files outside this PR scope.

[Copilot]

@copilot review

Reviewed the two-file diff at 850c82d. The request_for_gap logic, catalog lookup, and test assertions are correct.

One issue found: cargo clippy -D warnings was failing on two newly-added test files (sccm_server_provider_and_admin_service_fixture_contract.rs and sccm_server_hierarchy_and_replication_fixture_contract.rs) due to clippy::collapsible_match — an inner if inside a match arm that can be expressed as a match guard. Fixed in commit fix(lint): collapse match guards to satisfy clippy::collapsible_match. All 18 server intake tests and 138 spine contract tests remain green after the fix.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/cmtraceopen-parser/src/sccm/server/windows/intake.rs:899

• usable_compatible_candidate is derived from logical_source_key, but that key currently ignores producer_host_handle and workflow_subject_handle. With the provenance scoping work (stacked on #430), a captured artifact on one host/subject can incorrectly suppress the default-candidate request for an absent artifact on a different host/subject that happens to share the same (producer_role, source_id, workflow_subject_role).

Consider including the host/subject handles in logical_source_key so request suppression stays scoped to the same provenance dimensions as artifact identity.

        && usable_compatible_candidate
    {
        return None;
    }
    if !matches!(

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[adamgell]

@coderabbitai full review

[adamgell]

Exact-head review checkpoint for 46a7d06efd66cf989756c5a9989e896f78f70079: the suppressed Copilot topology finding was reproduced RED for both producer-host and workflow-subject boundaries, fixed test-first, and rerun green. Local CodeRabbit exact committed comparison reports 0 findings; exact-head Copilot reports no new comments. Hosted Linux/Windows CI is still completing, so this PR is not merged yet.

[coderabbitai]

✅ Action performed

Full review finished.