forked from ek0mssavi0r/Flock_SCAN
leetcrypt
51ba69a541
Makes the passive tap a defensible auditing instrument for the "does this camera phone home to Flock?" question, while shrinking what it retains about bystanders. Nothing here widens third-party capture. - Unified verdict vocabulary. A single private _classify() folds flow-stat and device-level signals into exactly one of CLOUD_CONNECTED / LOCAL_STATION / INDETERMINATE. classify_device/classify_camera become thin wrappers. Previously the two classifiers returned divergent sets (OFFLINE_OR_UNMONITORED, NO_DATA, UNKNOWN) that fell out of every summary bucket, so totals never reconciled. - Report counts now reconcile. Summary buckets partition every tracked IP; counts_reconcile asserts cloud+local+indeterminate == total_ips_tracked. - Explainable cloud verdicts. Record known-Flock IPs a device contacted (cloud_ip_contacts) and surface CLOUD_IP(...) evidence, plus a TLS_CATEGORY(...) fallback, so a cloud verdict is never unexplained. - Bounded captures. Per-device raw sample lists cap at max_samples (default 500, --tap-max-samples). Exact integer counters increment regardless, so verdict inputs and report totals stay precise past the cap. - Bystander protection. FRP auth detection stores a non-content descriptor (matched keyword + payload length) instead of 64 raw payload bytes. Optional --tap-redact-ips salt-hashes non-Flock destination IPs in stored samples; known-Flock IPs stay legible so cloud evidence is readable. - Metadata-only destination_summary per cloud device (DNS names, TLS SNIs, known-Flock IPs) — who it talks to, never payload contents. Tests extend the merged suite with audit-integrity coverage (vocabulary agreement, bucket reconciliation, indeterminate counting, CLOUD_IP evidence, sample capping vs exact counters, FRP descriptor, IP redaction, metadata-only summary). Stale-vocabulary assertions updated to INDETERMINATE. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>