Fix attack type normalization and safe classification leak in graph

src/db/graph_writer.py

@@ -61,9 +61,14 @@ async def write_threat_events_batch(events_data: list) -> None:
         if hasattr(timestamp, "isoformat"):
             timestamp = timestamp.isoformat()
 
+        raw_attack = log_entry.get("attack_type") or "unknown_attack"
+        if raw_attack.lower() == "safe":
+            raw_attack = "cumulative_risk_exceeded"
+        normalized_attack = raw_attack.lower().replace(" ", "_")
+
         formatted_events.append({
             "key_id": str(log_entry.get("api_key_id", "unknown")),
-            "attack_type": log_entry.get("attack_type") or "unknown_attack",
+            "attack_type": normalized_attack,
             "flagged_layer": log_entry.get("flagged_layer") or "unknown_layer",
             "flagged_pattern": str(log_entry.get("flagged_pattern") or "none"),
             "prompt_hash": log_entry.get("prompt_hash", "unknown_hash"),

src/layers/pipeline.py

@@ -182,7 +182,7 @@ class ClassifierPipeline:
             return build_short_circuit(
                 flagged_name="rule_based",
                 risk=current_risk,
-                attack=rule_res.attack_category,
+                attack=rule_res.attack_category.lower().replace(" ", "_") if rule_res.attack_category else "unknown_rule",
                 pattern=rule_res.matched_pattern,
                 running_layers=layers_data
             )
@@ -263,10 +263,13 @@ class ClassifierPipeline:
             layers_data["ml_classifier"]["reason"] = ml_res.reason
 
         if is_ml_triggered and ml_res.ran:
+            attack_class = ml_res.attack_class or "unknown"
+            if attack_class.lower() == "safe":
+                attack_class = "cumulative_risk_exceeded"
             return build_short_circuit(
                 flagged_name="ml_classifier",
                 risk=current_risk,
-                attack=ml_res.attack_class,
+                attack=attack_class.lower().replace(" ", "_"),
                 pattern=f"ML classified threat: {ml_res.attack_class} (cumulative)",
                 running_layers=layers_data
             )