[adulau]

PAP:RED intelligence can currently reach expansion handlers without a central policy check. Add the global --restrict-pap-red startup option, disabled by default, to reject marked hover requests and external expansion before any handler executes. Default requests, handler payloads and legacy JSON bytes retain their existing behavior.

When enabled:

• Check supplied attribute, object and event markings, including MISP tag wrappers and a top-level tags array for simplified requests. A PAP:RED marking at any supplied level wins.
• Block PAP:RED hover requests regardless of source. A top-level hover: true identifies hover calls; hover-only modules are recognised automatically.
• Allow PAP:RED manual expansion only for modules declaring data-source: internal in trusted metadata. External, missing and unrecognised declarations are blocked. Add initial declarations for the Sigma syntax validator and DNS resolver.
• Return the existing HTTP 200 module-error format and record rejections as module_errors. Request configuration cannot override the server policy or source declaration. Import, export and action modules retain their existing behavior.

Document startup configuration, source declarations, request context and the integration boundary, and add the optional request fields to OpenAPI.

MISP integration

Related to #576. This supplies the misp-modules server policy, rather than claiming complete end-to-end resolution: current MISP hover paths can omit tags and a hover indicator. Callers must forward effective attribute/object/event tags and identify hover calls. Requests without supplied PAP:RED markings retain their behavior; the module service cannot infer missing parent tags from an attribute ID or value. MISP-side forwarding remains necessary for complete protection, so this PR deliberately does not close the issue.

Validation

• 148 focused PAP policy, module configuration, statistics, HTTP debugging and DNS regression tests passed.
• Black, isort and flake8 passed for the changed Python implementation; Black and isort also passed for the new tests.
• CLI help, documentation YAML syntax and git diff --check verified.

The HTTP tests exercise both handler styles, default compatibility, parent markings, source and hover decisions, inability to bypass the policy through request config, discovery metadata and rejected-request statistics. Tests use local servers and mocked module handlers; no external intelligence service is contacted.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T20:54:08.358289Z	614489d	PR opened
🔒 Security Review	✅ Completed 2026-10-28T20:54:58.923656Z	614489d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.