refactor(ae): rename dx_attack_graph → dx_evidence_graph (malignant view)

[ConstanzeTU]

What

Renames the AE forensic dx graph across the whole path, stacked on top of #73 (the /query runner):

Kind	Before	After
table	forensic_db.dx_attack_graph	forensic_db.dx_evidence_graph
view	dx_attack_graph_malicious	dx_evidence_graph_malignant
endpoint	/dx/attack_graph	/dx/evidence_graph
Go	WriteAttackGraph, handleDXAttackGraph	WriteEvidenceGraph, handleDXEvidenceGraph

Medical terminology per request: malignant, not malicious.

How

The prior refactor/ae-evidence-graph-rename branch was built on a divergent pre-consolidation AE lineage (shared only an ancient merge-base with #73). Rather than restack that history, the rename was re-applied mechanically on the current #73 tip — which also catches order_query_test.go, a query-runner file absent from the old branch's lineage.

Incidental #73 lint fixes (surfaced by touching the package)

• order_query_test.go: gofumpt blank lines between funcs.
• controller/BUILD.bazel: added the missing order_query_test.go to controller_test srcs (gazelle staleness pre-existing on adaptive_export: wire the /query runner — dx OrderQuery → forensic capture (dx#93) #73).

Stacking

Base = feat/ae-query-runner (#73). Merge #73 first. Release build kicked from this tip.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 349dd3d7-0c5b-457b-9f16-810eddc05239

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/ae-evidence-graph-rename

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[entlein]

AE gap found while testing dx 0.3.0-integration — need /dx/evidence_manifest

aeprod26 (built from this PR) ships /dx/evidence_graph correctly, but the next dx round adds a second export endpoint the AE doesn't serve yet. Flagging here so it lands in the same AE line.

Probe (rig 6a46404f, aeprod26 control @ :9100):

POST /dx/evidence_graph    → 202   ✅ (this PR)
POST /dx/evidence_manifest → 404   ❌ (missing)

Why dx needs it: dx feat/noise-suite / 0.3.0-integration (PLAN §9 remediation, Phase 0.1) builds a per-verdict evidence Manifest (internal/manifest) and ships it via aeclient.WriteEvidenceManifest → CallJSON("/dx/evidence_manifest", m) (aeclient.go:138). It's the backing for the export-completeness claim (dx_manifest_rows_exported_total / dx_manifest_rows_total).

Measured impact (m6 e2e, integration image):

• dx_manifest_rows_total = 2278 (consulted rows the manifest tracked)
• dx_manifest_rows_exported_total = 0 ← every export 404s
• dx_graph_write_failures_total{kind="manifest"} = 15
• → the §9 completeness ratio is unmeasurable end-to-end until the AE serves this endpoint.

Suggested fix (mirror the evidence_graph path in this PR): add s.mux.HandleFunc("/dx/evidence_manifest", s.handleDXEvidenceManifest) in internal/control/server.go, a WriteEvidenceManifest writer, and the forensic_db.dx_evidence_manifest table DDL (internal/clickhouse/) — same shape as handleDXEvidenceGraph → dx_evidence_graph. JSON payload is the sealed manifest.Manifest (one object per verdict; rows are the consulted evidence with the case/verdict join key).

Everything else in aeprod26 verified good (evidence_graph 202, metastasis reconstructs, DDL creates dx_evidence_graph/_malignant). — dx-agent