validate.py: flag default:true condition nodes that fail release (#38)

* validate.py: flag default:true condition nodes that fail release

A condition node that routes only via a node-level 'default: true' (no
cel_expression/expression and no else:) imports cleanly and passes server-side
validate_only, then fails at release with 'exclusive gateway ... has no
condition set and is not marked as default'. Verified live against the tenant:
the release (enable) API does not honor a node-level 'default: true' — proven on
a synthetic default-only fan-out, a mixed if/else, and the real console-exported
default_gateway_decision_* shape, all of which release-failed identically. The
valid default mechanism is an 'else:' branch on the expression-bearing condition
(which becomes the gateway's default flow); converting the shipped shape to
'else:' releases OK.

_validate_conditions previously treated 'default: true' as satisfying the
requirement (is_default), a false-negative. It now requires each condition to
carry a match expression OR an 'else:' branch. This matches the contract already
documented in yaml-schema.md.

Also converts two shipped tutorial examples that used the release-broken
'default: true' shape (intro-receive-email-trigger, intro-lookup-file-actions)
to the 'else:' form; both re-verified to release cleanly on the tenant. A third
example (network-contain-endpoint-on-detection) carries the same broken shape
including a 5-way gateway; its conversion is deferred to a supervised session
because it is a containment workflow that cannot be safely release-verified
unattended (no CI impact — no example sweep runs validate.py).

Tests: replaces the stale test that asserted default:true passes with one that
asserts it is flagged, adds a regression test for the console default_gateway_
decision_* shape, and one for the valid expression+else replacement. pylint
10.00/10, 143 test_validate cases pass, markdownlint clean.

* examples: convert network-contain default:true gateways to else: / else_if form

Completes the example fixes for the default:true release-failure. All three
gateways in network-contain-endpoint-on-detection.yaml used the release-broken
'default: true' shape:

- DeviceQuery gateway (2-way): default -> the device-query condition's 'else:'.
- UpdateVariable gateway (2-way): default -> enable_preventive's 'else:'.
- 5-way product gateway: the four product conditions now chain via 'else_if'
  (epp -> quickscanpro -> data-protection -> ngsiem), with the terminal 'else:'
  carrying the old default target (AddCommentToDetection2). Product type is
  single-valued, so ordered else_if evaluation is equivalent to the original
  exclusive gateway. enable_preventive keeps its own 'else:' (var-false path).

The default nodes were removed and dropped from their source 'next:' lists; all
three former default targets stay reachable exactly once. validate.py passes all
tiers including server-side validate_only. The else_if-chain structure was
release-proven on an inert On-demand probe (release checks gateway structure, not
expression content) and the 2-way pattern on the two tutorial examples; a live
release of this containment workflow itself was intentionally not run (its
approval-gated containment can't fire in a brief window, but enabling it could
send an approval email on a qualifying detection).

Author: mraible

.pylintrc

@@ -337,7 +337,7 @@ max-line-length=127
 # with many per-trigger/per-class rules); it has grown past the 1000 default as
 # rules were added. Kept as one module intentionally — splitting tightly-related
 # validation logic purely to satisfy a line count would hurt readability.
-max-module-lines=1300
+max-module-lines=1350
 
 # Allow the body of a class to be on the same line as the declaration if body
 # contains single statement.

CHANGELOG.md

@@ -23,6 +23,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - Clarified that only class-based actions strictly *require* a `version_constraint` at import. A non-class action such as Device Query imports and releases without one; it just keeps the older, longer output paths.
 - **`validate.py` now catches the pinned/long-path mismatch before release.** The structural tier flags a `${data['...']}` reference that keeps an action's output namespace (`device.query`, `device.get_details`, `logscale.query_event`) while that action is pinned with a `version_constraint` — the exact shape that imports cleanly and passes server-side `validate_only`, then fails at release as an unknown variable. The error names the collapsed replacement (`${data['<node>.<field>']}`). An unpinned action legitimately keeps the long path, so the check fires only when the referenced node is pinned. This turns the documentation above into an enforced check; a release-gated eval had produced a workflow that imported clean and failed release on precisely this.
 - **MITRE ATT&CK trigger fields that release rejects on the NG-SIEM trigger are now flagged.** `Trigger.Detection.MitreAttack.Tactic` and `.Technique` are advertised by trigger discovery — including `trigger_search.py --fields` — on the `Investigatable/NGSIEM` trigger, but the release validator rejects them as unknown variables; they are not on the NG-SIEM trigger payload at release time. The structural validator now flags a workflow that references them on that trigger, and `trigger_search.py --fields` marks them "NOT release-valid" so the tool stops steering authors toward a field that fails at release. Source MITRE tactics/techniques from the hydrated detection instead. Surfaced by a release-gated eval; confirmed live.
+- **A `default: true` condition node is now flagged, because it fails release.** A condition that routes only via a node-level `default: true` (no `cel_expression`/`expression`, no `else:`) imports cleanly and passes server-side `validate_only`, then fails at release with `exclusive gateway ... has no condition set and is not marked as default`. Verified live against a tenant — the release API does not honor a node-level `default: true`, including the console-exported `default_gateway_decision_*` shape. A gateway's default flow is the `else:` branch of the expression-bearing condition, so the structural validator now requires every condition to carry an expression or an `else:` (a bare `default: true` no longer counts). Two shipped tutorial examples, `intro-receive-email-trigger` and `intro-lookup-file-actions`, used the `default: true` shape and would have failed release; both were converted to the `else:` form and re-verified to release cleanly. A third, `network-contain-endpoint-on-detection`, used it across three gateways (including a five-way product gateway that became an `else_if` chain); it was converted and now **releases cleanly (verified live)**, together with the recipient fix below.
+- **A missing or fake `to` recipient on the Request human input "send email" action is now flagged.** Like the plain Send email action, it requires a `to` recipient at release (`A value is required for the property "to"`), but server-side `validate_only` does not enforce it — so a workflow passed every local check and failed at release (surfaced live on `network-contain-endpoint-on-detection`, whose four approval-email actions had no `to`). The recipient check now covers both email actions: it flags a missing/empty `to`, the wrong `recipients:` key, and a hardcoded fake-domain address (e.g. `@example.com`) that dead-ends at runtime because no CID approves it. The right recipient is a variable the user supplies — a trigger parameter, a `WorkflowCustomVariable`, or a value from a prior step — which is what the fixed `network-contain` example now uses (`${WorkflowCustomVariable.approver_email}`).
 
 ## [1.0.1] - 2026-08-07
 

skills/authoring/examples/notifications/network-contain-endpoint-on-detection.yaml

@@ -160,13 +160,14 @@ actions:
         properties:
           enable_preventive_actions:
             type: boolean
+          approver_email:
+            type: string
         type: object
   DeviceQuery:
     id: 68ffa99af40c84b36462daa076f535d0
     name: Device Query
     next:
       - data_devicequery_device_query_devices_null_data_devicequery_
-      - default_gateway_decision_63c53687_1b30_4b66_ba86_f4692d189b2
     properties:
       hostnames:
         - ${Trigger.Detection.NGSIEM.HostNames}
@@ -185,6 +186,7 @@ actions:
       msg: "<p>Hi Team</p>\n<p>A detection requires containment approval as per the <strong>${data['Workflow.Definition.Name']}</strong> workflow. </p>\n<p><strong>Detection Details:</strong></p>\n<ul>\n  <li><strong>Host:</strong> ${data['Trigger.Detection.EPP.Sensor.Hostname']}</li>\n  <li><strong>Detection Name:</strong> <a href=\"${data['Trigger.Detection.EPP.URL']}\">${data['Trigger.Detection.Name']}</a></li>\n  <li><strong>Severity:</strong> ${data['Trigger.Detection.SeverityDisplayName']}</li>\n  <li><strong>Tactic:</strong> ${data['Trigger.Detection.EPP.Behavior.TacticName']}</li>\n</ul>\n<p><strong>Action Required:</strong><br>Please review the detection and approve/deny containment action.</p>\n"
       msg_type: html
       responders: []
+      to: ${WorkflowCustomVariable.approver_email}
       subject: Approve Containment for ${data['Trigger.Detection.SeverityDisplayName']} on ${data['Trigger.Detection.EPP.Sensor.Hostname']}
       user_input_timeout: 90m
   RequestHumanInputSendEmail2:
@@ -200,6 +202,7 @@ actions:
       msg: "<p>Hi Team</p>\n<p>A detection requires containment approval as per the <strong>${data['Workflow.Definition.Name']}</strong> workflow.</p>\n<p><strong>Detection Details:</strong></p>\n<ul>\n<li><strong>Product Type:</strong> ${data['Trigger.Detection.Product']}</li>\n  <li><strong>HostID:</strong> ${data['Trigger.Detection.QUICKSCANPRO.AgentID']}</li>\n  <li><strong>Detection Name:</strong> <a href=\"${data['Trigger.SourceEventURL']}\">${data['Trigger.Detection.Name']}</a></li>\n  <li><strong>Severity:</strong> ${data['Trigger.Detection.SeverityDisplayName']}</li>\n  <li><strong>Description:</strong> ${data['Trigger.Detection.Description']}</li>\n</ul>\n<p><strong>Action Required:</strong><br>Please review the detection and approve/deny containment action.</p>\n"
       msg_type: html
       responders: []
+      to: ${WorkflowCustomVariable.approver_email}
       subject: 'Approve Containment for ${data[''Trigger.Detection.SeverityDisplayName'']} ${data[''Trigger.Detection.Product'']} Detection on HostID: ${data[''Trigger.Detection.QUICKSCANPRO.AgentID'']}'
       user_input_timeout: 90m
   RequestHumanInputSendEmail3:
@@ -217,6 +220,7 @@ actions:
       msg: "<p>Hi Team</p>\n<p>A detection requires containment approval as per the <strong>${data['Workflow.Definition.Name']}</strong> workflow.</p>\n<p><strong>Detection Details:</strong></p>\n<ul>\n<li><strong>Product Type:</strong> ${data['Trigger.Detection.Product']}</li>\n  <li><strong>HostID:</strong> ${data['Trigger.Detection.DataProtection.AgentID']}</li>\n  <li><strong>Detection Name:</strong> <a href=\"${data['Trigger.SourceEventURL']}\">${data['Trigger.Detection.Name']}</a></li>\n  <li><strong>Severity:</strong> ${data['Trigger.Detection.SeverityDisplayName']}</li>\n  <li><strong>Description:</strong> ${data['Trigger.Detection.Description']}</li>\n</ul>\n<p><strong>Action Required:</strong><br>Please review the detection and approve/deny containment action.</p>"
       msg_type: html
       responders: []
+      to: ${WorkflowCustomVariable.approver_email}
       subject: 'Approve Containment for ${data[''Trigger.Detection.SeverityDisplayName'']} on HostID: ${data[''Trigger.Detection.DataProtection.AgentID'']}'
       user_input_timeout: 90m
   RequestHumanInputSendEmail5:
@@ -232,6 +236,7 @@ actions:
       msg: "<p>Hi Team</p>\n<p>A detection requires containment approval as per the <strong>${data['Workflow.Definition.Name']}</strong> workflow.</p>\n<p><strong>Detection Details:</strong></p>\n<ul>\n<li><strong>Product Type:</strong> ${data['Trigger.Detection.Product']}</li>\n<li><strong>Hostnames:</strong><br><pre style=\"font-family: inherit; margin: 5px 0; white-space: pre-wrap;\">${data['Trigger.Detection.NGSIEM.HostNames']}</pre></li>\n  <li><strong>Detection Name:</strong> <a href=\"${data['Trigger.SourceEventURL']}\">${data['Trigger.Detection.Name']}</a></li>\n  <li><strong>Severity:</strong> ${data['Trigger.Detection.SeverityDisplayName']}</li>\n  <li><strong>Description:</strong> ${data['Trigger.Detection.Description']}</li>\n</ul>\n<p><strong>Action Required:</strong><br>Please review the detection and approve/deny containment action.</p>\n"
       msg_type: html
       responders: []
+      to: ${WorkflowCustomVariable.approver_email}
       subject: Approve Containment for ${data['Trigger.Detection.SeverityDisplayName']} ${data['Trigger.Detection.Product']} Detection on host(s)
       user_input_timeout: 90m
   UpdateVariable:
@@ -241,7 +246,6 @@ actions:
     version_constraint: ~1
     next:
       - enable_preventive_actions_is_equal_to_true
-      - default_gateway_decision_0471ba1a_f139_4b22_b615_dd2263acf59
     properties:
       WorkflowCustomVariable:
         enable_preventive_actions: false
@@ -287,17 +291,11 @@ conditions:
   enable_preventive_actions_is_equal_to_true:
     next:
       - data_trigger_detection_product_epp_data_trigger_detection_ep
-      - data_trigger_detection_product_quickscanpro_data_trigger_det
-      - data_trigger_detection_product_data_protection_data_trigger_
-      - data_trigger_detection_product_ngsiem_data_trigger_detection
-      - default_product_is_equal_to_epp_detection
+    else:
+      - AddCommentToDetection
     expression: WorkflowCustomVariable.enable_preventive_actions:true
     display:
       - enable_preventive_actions is equal to True
-  default_gateway_decision_0471ba1a_f139_4b22_b615_dd2263acf59:
-    next:
-      - AddCommentToDetection
-    default: true
   product_is_equal_to_epp_detection_product_is_equal_to_quicks:
     next:
       - CreateVariable
@@ -313,13 +311,11 @@ conditions:
   data_devicequery_device_query_devices_null_data_devicequery_:
     next:
       - RequestHumanInputSendEmail5
+    else:
+      - AddCommentToDetection11
     cel_expression: data['DeviceQuery.Device.query.devices'] != null && data['DeviceQuery.Device.query.devices'].size() > 0
     display:
       - data[&#39;DeviceQuery.Device.query.devices&#39;] != null &amp;&amp; data[&#39;DeviceQuery.Device.query.devices&#39;].size() &gt; 0
-  default_gateway_decision_63c53687_1b30_4b66_ba86_f4692d189b2:
-    next:
-      - AddCommentToDetection11
-    default: true
   human_response_is_equal_to_approve:
     next:
       - ContainDevice3
@@ -371,31 +367,32 @@ conditions:
   data_trigger_detection_product_epp_data_trigger_detection_ep:
     next:
       - RequestHumanInputSendEmail
+    else_if: data_trigger_detection_product_quickscanpro_data_trigger_det
     cel_expression: data['Trigger.Detection.Product'] == 'EPP' && data['Trigger.Detection.EPP.Sensor.SensorID'].size()>0
     display:
       - data[&#39;Trigger.Detection.Product&#39;] == &#39;EPP&#39; &amp;&amp; data[&#39;Trigger.Detection.EPP.Sensor.SensorID&#39;].size()&gt;0
   data_trigger_detection_product_quickscanpro_data_trigger_det:
     next:
       - RequestHumanInputSendEmail2
+    else_if: data_trigger_detection_product_data_protection_data_trigger_
     cel_expression: data['Trigger.Detection.Product'] == 'QUICKSCANPRO' && data['Trigger.Detection.QUICKSCANPRO.AgentID'].size()>0
     display:
       - data[&#39;Trigger.Detection.Product&#39;] == &#39;QUICKSCANPRO&#39; &amp;&amp; data[&#39;Trigger.Detection.QUICKSCANPRO.AgentID&#39;].size()&gt;0
   data_trigger_detection_product_data_protection_data_trigger_:
     next:
       - RequestHumanInputSendEmail3
+    else_if: data_trigger_detection_product_ngsiem_data_trigger_detection
     cel_expression: data['Trigger.Detection.Product'] == 'DATA-PROTECTION' && data['Trigger.Detection.DataProtection.AgentID'].size()>0
     display:
       - data[&#39;Trigger.Detection.Product&#39;] == &#39;DATA-PROTECTION&#39; &amp;&amp; data[&#39;Trigger.Detection.DataProtection.AgentID&#39;].size()&gt;0
   data_trigger_detection_product_ngsiem_data_trigger_detection:
     next:
       - DeviceQuery
+    else:
+      - AddCommentToDetection2
     cel_expression: data['Trigger.Detection.Product'] == 'NGSIEM' && data['Trigger.Detection.NGSIEM.HostNames'].size() > 0
     display:
       - data[&#39;Trigger.Detection.Product&#39;] == &#39;NGSIEM&#39; &amp;&amp; data[&#39;Trigger.Detection.NGSIEM.HostNames&#39;].size() &gt; 0
-  default_product_is_equal_to_epp_detection:
-    next:
-      - AddCommentToDetection2
-    default: true
 loops:
   Loop:
     display: For each Sensor IDs; Concurrently

skills/authoring/examples/tutorials/intro-lookup-file-actions.yaml

@@ -7,7 +7,6 @@ description: Learn how to use lookup file actions from Fusion. This workflow use
 trigger:
   next:
     - data_filename_endswith_csv_true
-    - default_gateway_decision_a99962c3_9f64_4633_b4de_27f43ea4753
   name: On demand
   type: On demand
   parameters:
@@ -166,13 +165,11 @@ conditions:
   data_filename_endswith_csv_true:
     next:
       - GetLookupFileMetadata
+    else:
+      - PrintData2
     cel_expression: data['filename'].endsWith('.csv') == true
     display:
       - data['filename'].endsWith('.csv') == true
-  default_gateway_decision_a99962c3_9f64_4633_b4de_27f43ea4753:
-    next:
-      - PrintData2
-    default: true
   lookup_file_exists_is_equal_to_false:
     next:
       - CreateANewLookupFileIfLookupFileDoesntExist

skills/authoring/examples/tutorials/intro-receive-email-trigger.yaml

@@ -7,7 +7,6 @@ description: Learn how to create a lookup file from a file attachment. Requires
 trigger:
   next:
     - data_trigger_monitoredemail_attachmentfiles_null_data_trigge
-    - default_gateway_decision_ae829b82_ef89_45bf_85e8_8340bd76251
   name: Receive email
   event: MonitoredEmail
   type: Signal
@@ -32,10 +31,8 @@ conditions:
   data_trigger_monitoredemail_attachmentfiles_null_data_trigge:
     next:
       - CreateLookupFileWithoutLoop
+    else:
+      - PrintData
     cel_expression: "data['Trigger.MonitoredEmail.AttachmentFiles'] != null &&\ndata['Trigger.MonitoredEmail.AttachmentFiles'].exists(s,\n  s != null && s != '' &&\n  cs.json.valid(s) &&\n  cs.json.decode(s)['Name'] != null &&\n  cs.json.decode(s)['Name'] != '' &&\n  cs.json.decode(s)['Name'].endsWith('.csv')\n)"
     display:
       - "data['Trigger.MonitoredEmail.AttachmentFiles'] != null &&\ndata['Trigger.MonitoredEmail.AttachmentFiles'].exists(s,\n  s != null && s != '' &&\n  cs.json.valid(s) &&\n  cs.json.decode(s)['Name'] != null &&\n  cs.json.decode(s)['Name'] != '' &&\n  cs.json.decode(s)['Name'].endsWith('.csv')\n)"
-  default_gateway_decision_ae829b82_ef89_45bf_85e8_8340bd76251:
-    next:
-      - PrintData
-    default: true

skills/authoring/references/yaml-schema.md

@@ -266,10 +266,12 @@ actions:
     EnrichHash:   { id: ..., next: [SummarizeEnrichment], properties: {...} }
 ```
 
-Do **not** invent pass-through condition nodes (`default_parallel_*` with
-`default: true`) to model the fan-out. The console cannot build canvas edges from
-those synthetic nodes and the visual editor crashes on import — even though the
-workflow deploys and runs. List the real targets in `next:` instead.
+Do **not** invent pass-throughcondition nodes (`default_parallel_*` with
+`default: true`) to model the fan-out. Release rejects those synthetic nodes
+(`exclusive gateway ... has no condition set and is not marked as default`,
+confirmed live — the release API does not honor a node-level `default: true`),
+and the visual editor also crashes on import. List the real targets in `next:`
+instead.
 
 Do **not** model parallel work as a serial chain
 (`EnrichDomain → EnrichIP → EnrichHash`). A serial chain runs each call only