spec

spec

Declarative rule spec for the lambda-rule subsystem.

A :class:RuleSpec is the user-facing description of one detection rule. It carries everything the loader needs to (a) compile the trigger expression, (b) build a :class:~ts_shape.eventlog.taxonomy.LabelRule, and (c) classify the rule into an archetype that tests/eventlog/test_adapter_coverage.py already validates.

The shape mirrors the built-in detector taxonomy: every lambda rule ultimately becomes a (class_name, method_name) REGISTRY entry that the canonical :func:~ts_shape.eventlog.to_event_log dispatcher understands without any special-case code.

TriggerSpec dataclass

TriggerSpec(
    expression: str,
    min_duration_s: float | None = None,
    group_by: tuple[str, ...] = (),
)

When does the rule fire?

expression is evaluated against the input DataFrame by the AST-restricted compiler in :mod:.expression. It must produce a boolean Series aligned with the input rows.

min_duration_s and group_by are only meaningful for shape="interval" rules: consecutive True rows are coalesced (per group) and the resulting interval is dropped if shorter than min_duration_s seconds.

RuleSpec dataclass

RuleSpec(
    id: str,
    class_name: str,
    method_name: str,
    pack: str,
    shape: str,
    archetype: str,
    template: str,
    trigger: TriggerSpec,
    produces_objects: tuple[str, ...] = ("asset",),
    severity_field: str | None = None,
    value_field: str | None = None,
    standard_attrs: Mapping[str, object] = dict(),
)

A complete lambda-rule definition.

Required fields mirror the built-in REGISTRY contract — class_name is synthesized (must start with Lambda) so the rule slots into the same (class, method) -> LabelRule table as the 290 built-ins.