Update the CyberForge ML service

app.py

@@ -16,6 +16,7 @@ import subprocess
 import sys
 import threading
 import time
+import uuid
 from pathlib import Path
 from datetime import datetime
 import logging
@@ -1318,12 +1319,77 @@ async def api_analyze(request: Request):
     return as_reasoning_text(result)
 
 
+ANALYSIS_SCHEMA = "cyberforge.ml.analysis.v1"
+VERDICT_POLICY = "trained_models_v1"
+
+
+def analysis_record(target: str, predictions: Dict, started: float) -> Dict:
+    """The versioned record of one analysis (V2-ML02), beside the older fields.
+
+    Verdict policy trained_models_v1: "threat" when any trained model answered
+    and flagged the target, "benign" when trained models answered and none
+    flagged it, "unknown" when no trained model answered (rule-based estimates
+    only). Scores are each model's output rescaled at its decision threshold:
+    raw scores, not calibrated probabilities, so no probability is given."""
+    detectors, warnings = [], []
+    for name, p in predictions.items():
+        trained = p.get("inference_source") == "ml_model"
+        meta = ml_loader.metadata.get(name, {}) if trained else {}
+        if "error" in p:
+            verdict = "unknown"
+        else:
+            verdict = "threat" if p.get("prediction") == 1 else "benign"
+        detectors.append({
+            "id": name,
+            "engine": "trained_model" if trained else "heuristic",
+            "verdict": verdict,
+            "raw_score": p.get("threat_score"),
+            "calibrated_probability": None,
+            "trained_at": meta.get("trained_at"),
+            "decision_threshold": meta.get("decision_threshold"),
+            "feature_set": meta.get("feature_set"),
+            "missing_features": p.get("missing_features"),
+        })
+        if not trained:
+            why = p.get("note") or ("features were missing" if p.get("missing_features") else "the model is not loaded")
+            warnings.append(f"{name}: rule-based estimate, not the trained model ({why})")
+    answered = [d for d in detectors if d["engine"] == "trained_model" and d["verdict"] != "unknown"]
+    if not answered:
+        verdict, reason = "unknown", "no trained model answered; only rule-based estimates are available"
+    elif any(d["verdict"] == "threat" for d in answered):
+        flagged = [d["id"] for d in answered if d["verdict"] == "threat"]
+        verdict, reason = "threat", f"flagged by {', '.join(flagged)}"
+    else:
+        verdict, reason = "benign", f"{len(answered)} trained model(s) answered and none flagged it"
+    warnings.append("scores are model outputs rescaled at each decision threshold, not calibrated probabilities")
+    return {
+        "schema": ANALYSIS_SCHEMA,
+        "analysis_id": uuid.uuid4().hex,
+        "task": "url",
+        "target": target,
+        "verdict": verdict,
+        "verdict_reason": reason,
+        "policy": VERDICT_POLICY,
+        "coverage": {
+            "detectors": len(detectors),
+            "trained_models_answered": len(answered),
+            "heuristic_estimates": sum(1 for d in detectors if d["engine"] == "heuristic"),
+            "reputation_list_loaded": popular_domains_loaded(),
+        },
+        "detectors": detectors,
+        "service_version": SERVICE_VERSION,
+        "duration_ms": round((time.perf_counter() - started) * 1000, 1),
+        "warnings": warnings,
+    }
+
+
 @api.post("/analyze-url")
 async def api_analyze_url(request: Request):
     """URL analysis – called by backend mlService.analyzeWebsite()
     Returns per-model predictions + unified aggregate with risk_score (0-100).
     All models now consistently include threat_score (probability of class-1).
     """
+    started = time.perf_counter()
     body = await json_object(request)
     url = text_field(body, "url")
     if not url:
@@ -1384,6 +1450,7 @@ async def api_analyze_url(request: Request):
         "model_predictions": predictions,
         "features_analyzed": features,
         "timestamp": datetime.utcnow().isoformat(),
+        "analysis": analysis_record(url, predictions, started),
     }