feat(netexec): including signature manager and expectation signature (#200)

[mariot]

Proposed changes

• Adds ExpectationSignature support to the Netexec injector.

• Registers ExpectationSignature as a contract output across all Netexec contract types

• Integrates SignatureManager (from pyoaev feat/us-int-1-signature-lifecycle) into OpenAEVNetExecInjector:

  • Instantiated once on __init__
  • _build_target_meta() maps assets/asset groups from inject data
  • Compiles pre/post-execution signatures per run
  • Sends payloads for both DETECTION and PREVENTION expectation types

• Adds NETEXEC_SIGNATURE_TYPES frozenset in signature_helper.py

Testing Instructions

1. Step-by-step how to test
2. Environment or config notes

Related issues

• Closes feat(netexec): create its own signatures for inject expectations #200

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

Further comments

[codecov]

Codecov Report

❌ Patch coverage is 85.36585% with 6 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
netexec/netexec/openaev_netexec.py	83.78%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #245      +/-   ##
==========================================
+ Coverage   67.52%   68.07%   +0.55%     
==========================================
  Files          68       75       +7     
  Lines        3138     3352     +214     
==========================================
+ Hits         2119     2282     +163     
- Misses       1019     1070      +51     

Files with missing lines	Coverage Δ
netexec/netexec/contracts/contract_outputs.py	100.00% <100.00%> (+24.00%)	⬆️
netexec/netexec/contracts/output_registry.py	100.00% <100.00%> (+20.00%)	⬆️
netexec/netexec/helpers/signature_helper.py	100.00% <100.00%> (ø)
netexec/netexec/openaev_netexec.py	68.78% <83.78%> (ø)

... and 6 files with indirect coverage changes

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR adds ExpectationSignature support to the NetExec injector by integrating the pyoaev SignatureManager into the execution lifecycle and declaring ExpectationSignature as an output element for all NetExec contracts, with accompanying tests/specs.

Changes:

• Integrate SignatureManager into OpenAEVNetExecInjector to compile pre-/post-execution signatures and send them after execution.
• Append an ExpectationSignature ContractOutputElement to every NetExec contract’s outputs.
• Add signature-related tests (and Gherkin-style feature descriptions) plus new signature helper constants.

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
netexec/netexec/openaev_netexec.py	Integrates SignatureManager, compiles pre/post signatures, and sends signature payloads after execution.
netexec/netexec/contracts/contract_outputs.py	Adds ExpectationSignature output element and appends it for all contract output sets.
netexec/netexec/contracts/output_registry.py	Introduces EXPECTATION_SIGNATURE constant in the output registry.
netexec/netexec/helpers/signature_helper.py	Adds NETEXEC_SIGNATURE_TYPES frozenset for NetExec-relevant signature types.
netexec/test/conftest.py	Extends pyoaev module mocking to include signature-related modules for tests.
netexec/test/contracts/test_expectation_signature_output.py	Tests that ExpectationSignature is always included in built contract outputs.
netexec/test/contracts/expectation_signature_output.feature	Feature/spec describing expected ExpectationSignature presence across contracts.
netexec/test/signatures/test_netexec_signature_lifecycle.py	Tests signature lifecycle integration points (compile pre/post, send payload).
netexec/test/signatures/netexec_signature_lifecycle.feature	Feature/spec describing the desired signature lifecycle behavior.
netexec/test/signatures/init.py	Package marker for signatures tests.
netexec/test/signatures/conftest.py	Test package conftest placeholder (currently empty).

[guzmud]

Logs while testing against a locally-running OAEV stack while launching a netexec-based atomic testing

{
  "timestamp": "2026-06-25T12:45:00.160174Z",
  "level": "INFO",
  "name": "NetExec",
  "message": "Data: {'expectations': [{'expectation_type': 'VULNERABILITY', 'expectation_name': 'Not vulnerable', 'expectation_description': '', 'expectation_score': 100, 'expectation_expectation_group': False}], 'port': '', 'target_selector': 'assets', 'target_property_selector': 'automatic', 'targets': ''}"
}

{
  "timestamp": "2026-06-25T12:45:01.436000Z",
  "level": "INFO",
  "name": "NetExec",
  "message": "Execution details updated: %s", "attributes": "start_time=datetime.datetime(2026, 6, 25, 12, 45, 0, 166288, tzinfo=datetime.timezone.utc) end_time=datetime.datetime(2026, 6, 25, 12, 45, 1, 435730, tzinfo=datetime.timezone.utc) execution_status='success' execution_action=<InjectExecutionActions.COMPLETE: 'complete'> execution_message='Current action: complete - Current status: success' execution_duration=1.269442"
}

{
  "timestamp": "2026-06-25T12:45:01.436693Z",
  "level": "INFO",
  "name": "NetExec",
  "message": "Uploading signatures with payload: %s", "attributes": {"targets": [{"signature_target": {"agent": null, "asset": "28d38644-e5e1-4a67-bbe5-0c7fde87a5e4", "asset_group": null}, "signature_values": [{"expectation_type": "VULNERABILITY", "values": [{"signature_type": "start_time", "signature_value": "2026-06-25T12:45:00Z"}, {"signature_type": "end_time", "signature_value": "2026-06-25T12:45:01Z"}, {"signature_type": "source_ipv4", "signature_value": "127.0.1.1"}, {"signature_type": "target_hostname", "signature_value": "honey.scanme.sh"}]}]}]}
}

{
  "timestamp": "2026-06-25T12:45:01.437028Z",
  "level": "DEBUG",
  "name": "pyoaev.signatures.signature_manager",
  "message": "send_signatures inject_id=8efe1b9c-990b-4d95-9367-18d0d9df3b9a, execution_status=success, execution_action=InjectExecutionActions.COMPLETE"
}