[adbhogeGit]

Required items, please complete

Change(s):

• Enrich exact-row visibility shared-deadline errors with expected per-timestamp counts, the last observed per-timestamp counts, missing/undercounted timestamps, and the last query table where available.
• Re-raise the original deadline exception with its stage, message, status, and cause intact. Keep actual HTTP/KQL and malformed-response errors unchanged.
• Persist an explicit targetVisibility outcome in validation artifacts. Report parser ingestion as passed only when upload and target visibility passed; retain the existing public report-stage keys and nest visibility evidence under parserIngestion.
• Report schema from outputValidation.schemaValidation only; missing evidence remains not-run even when the DCR exists. That evidence is emitted after ASimDataTester succeeds and is authoritative for parser-DCR output, not a separate ASimSchemaTester execution.
• Preserve the original query error stage while distinguishing visibility failures; recognize the exact legacy shared-deadline artifact only when target-visibility timing confirms it and output validation did not start. Do not attribute unrelated query errors to visibility.
• Fix the CodeQL loop-variable-capture alert in the query-error regression cases by using an explicit response object. Add regressions for visibility success/deadline/not-run, legacy deadline artifacts, unrelated query errors, schema pass/fail/not-run, downstream stages, and runner artifact persistence. Document the reporting semantics.

Reason for Change(s):

• The reported MailLog canary run for [ASIM] Add Proofpoint POD MailLog ingestion-time parser #15463 passed filter validation (25 fixture rows, 24 selected, 1 rejected), compiled its DCR, and uploaded successfully, but expired while waiting roughly 900 seconds for target visibility. Its artifact recorded 31 successful query requests followed by stage query, message Validation deadline expired., and null details.
• The next query can hit the shared deadline before making a request, bypassing the polling loop's existing timeout diagnostics and discarding the last successful observation.
• Upload acceptance and DCR existence do not demonstrate target visibility or runtime output validation. The report now uses explicit stage outcomes and leaves output schema validation not-run when schemaValidation evidence was never produced.
• This PR fixes observability only. It does not resolve or claim to resolve the underlying canary ingestion timeout. It changes no parser YAML, user data, cloud resources, or catalog content.

Version Updated:

• N/A: validation-harness code, tests, and directly related documentation only; no detection/analytic-rule templates or parser versions changed.

Testing Completed:

• Yes: used Python 3.14.7 from the installed Azure CLI because the python command is a Windows Store alias.
• Focused harness tests: & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_ingestion_harness.py" -- 28 tests passed.
• Focused reporting tests: & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_ingestion_workflow.py" -- 43 tests passed.
• Complete ingestion-time regression suite: & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m unittest discover -s ".script\tests\asimParsersTest\ingestTimeParser\tests" -p "test_asim_*.py" -- 164 tests passed.
• The query-error response cases run as distinct subtests (HTTP 400, HTTP 403, malformed 200 response); each retains its own stage, status/details, and message. The former loop-captured callback was replaced by DeadlineResponse.
• & 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' -m compileall -q ".script\tests\asimParsersTest\ingestTimeParser" and git diff --check passed.

Checked that the validations are passing and have addressed any issues that are present:

• Yes: all local checks above passed. The test suite's intentional negative-path Output path must not replace the source fixture diagnostic is expected; the suite exits successfully.
• The reported CodeQL loop-variable-capture code alert is fixed and covered by the distinct passing subtests; GitHub rerun results are pending. The separate API-upload-configuration warning says the configuration on master was not found; it is a configuration warning, not a code alert.
• No live canary run was performed and no cloud resources were modified. The shared-canary ingestion timeout remains unresolved; remote PR validation results are pending.
• KQL/YAML content validation is not applicable because this PR changes no KQL/YAML content. The ingestion-time unit-test CI workflow defines no additional lint command.

[Copilot]

🟡 Changes recommended

Malformed visibility timestamps raise an unhandled ValueError, leaving targetVisibility.status as not-run and causing artifacts and reports to misrepresent a failed visibility check.

1 open issue

• Record malformed visibility timestamps as failed outcomes · New

What changed in this PR

This PR improves ASIM ingestion-time validation diagnostics when the shared canary deadline expires. It preserves visibility evidence and makes report outcomes reflect completed validation stages without claiming to resolve the ingestion timeout.

Changes:

• Preserve per-timestamp observations in deadline errors while retaining original exception details.
• Persist target-visibility outcomes and derive ingestion and schema status from validation evidence.
• Add regression coverage and document reporting semantics.

File	Description
.script/​tests/​asimParsersTest/​ingestTimeParser/​tests/​test_asim_ingestion_workflow.py	Tests visibility, schema, legacy-artifact, and downstream reporting outcomes.
.script/​tests/​asimParsersTest/​ingestTimeParser/​tests/​test_asim_ingestion_harness.py	Tests deadline diagnostics, error preservation, and visibility persistence.
.script/​tests/​asimParsersTest/​ingestTimeParser/​README.md	Documents visibility diagnostics and evidence-based reporting.
.script/​tests/​asimParsersTest/​ingestTimeParser/​asim_ingestion/​workflow/​reporting.py	Uses visibility and schema evidence to determine stage outcomes.
.script/​tests/​asimParsersTest/​ingestTimeParser/​asim_ingestion/​azure/​runner.py	Records explicit target-visibility results in validation artifacts.
.script/​tests/​asimParsersTest/​ingestTimeParser/​asim_ingestion/​azure/​client.py	Preserves the latest row observations when the shared deadline expires.

_{Review effort: Balanced}