Karib0u/rustinel

Problem #514 (for #423) split RawEvent from CanonicalEvent and kept three compatibility aliases in src/sensor/mod.rs: SensorEvent for RawEvent SensorPayload for RawPayload SensorEventHandler for CanonicalEventHandler About 460 references still use the aliases, against about 46 using the new names. The largest users are src/normalizer/mod.rs, src/sensor/linux/ebpf.rs, tests/common/mod.rs, src/sensor/macos/esf.rs, and src/sensor/windows/etw/. Separately, NormalizedEventHandler in src/engine/handler.rs receives a CanonicalEvent, so its name no longer matches. Proposal This is a mechanical rename, and a good first contribution: Replace every alias use; rg -w 'SensorEvent|SensorPayload|SensorEventHandler' finds them without touching SensorEventRouter. Delete the three aliases. Rename NormalizedEventHandler to a name that matches what it receives. Windows- and macOS-only code uses the aliases too, so rely on CI for the platforms you cannot build locally. Acceptance criteria The three a

Purpose Evaluate and, if justified, switch Rust test execution from cargo test to cargo-nextest for faster feedback, better failure reporting, and improved parallel test execution. This is workflow optimization rather than product functionality. Migration should be based on measured CI or developer feedback rather than tool preference alone. Current Usage Test commands currently use cargo test in: .github/workflows/ci.yml .github/workflows/rsigma-engine.yml .github/workflows/privileged-smoke.yml docs/development.md .github/pull_request_template.md Entry Criteria Before implementation, record at least one of: a representative CI runtime that materially delays feedback recurring test-output or flaky-retry problems that nextest addresses projected corpus-suite growth from #135 that makes the current runner impractical If no measurable problem exists, close this issue as not planned. Scope Measure current test duration and reporting behavior. Install and pin a cargo-nextest version in

Description Alert construction and event field mapping lack inline unit tests. The ECS contract test covers the main output path but not degradation behavior. Impact Refactors can introduce misleading default values or lose fields when event data is incomplete or unusual. Expected Behavior Optional fields are omitted when unavailable, alert construction remains valid without match details, and path and ECS normalization rules stay consistent. Suggested Fix Scope Add unit tests for missing PID, PPID, and user fields; unusual paths; absent match details; and ECS normalization or truncation. Test Expectations Unit expectations must agree with tests/ecs_contract.rs. Acceptance Criteria src/engine/alert.rs has inline tests. src/models/event.rs has inline tests. All four degradation areas have coverage.