@@ -91,6 +91,39 @@ An exact match can fail, and a failure is a real result; a ranked guess always r
9191something. When no recorded link exists, say so and say what you checked, so the next person
9292does not re-derive the same dead ends.
9393
94+ ### The framework shortens one path and no others
95+
96+ Every seeker copies matched evidence into ` <report folder>/data/ ` , so each ` files_found `
97+ entry is an absolute path on the machine running the tool. ` artifact_processor ` splits the
98+ ** third element** of your return tuple on ` \n ` and passes each piece through
99+ ` Context.get_relative_path ` . Nothing else is touched. A staged path placed in a data row goes
100+ verbatim into the HTML, the TSV, the timeline, the KML and the LAVA database, publishing the
101+ examiner's home directory, case folder and report layout to everyone who reads the report.
102+
103+ Shorten the path where it enters the row, not centrally afterwards:
104+
105+ ``` python
106+ data_list.append((timestamp, name, context.get_relative_path(file_found)))
107+ ```
108+
109+ Two things stop this showing up on its own:
110+
111+ - ` get_relative_path ` returns its input unchanged when the data folder is unset, so wherever
112+ that state is missing a leaking artifact and a correct one produce byte-identical output.
113+ The committed test harness is one such place, which is why a fixture comparison cannot tell
114+ them apart. Read a report from a real run instead.
115+ - A module that builds its own ` ArtifactHtmlReport ` rather than returning to the wrapper skips
116+ the normalization entirely, including its own "located at" line.
117+
118+ The third element itself has to be real paths, newline joined, because that is what the
119+ wrapper splits. Placeholder prose (` 'see the Source File column' ` ), several paths joined with
120+ ` '; ' ` or ` ', ' ` , and an empty string on a run that parsed data are all silent defects: the
121+ report's "located at" line then points nowhere. Return ` '' ` only from a branch where no file
122+ was found. A file that exists but lacks the expected table still reports its path.
123+
124+ ` admin/scripts/check_report_local_paths.py ` and ` admin/scripts/check_source_path.py ` gate both
125+ halves in CI. Run them before opening the PR.
126+
94127### Three failure modes that are silent by construction
95128
96129** An index keyed on a bare name merges two app data directories.** The moment you write
0 commit comments