Backlog/v12 soar flows interpolation

backend/modules/soar/usecase/dispatch.go

@@ -382,7 +382,7 @@ func (d *Dispatcher) fireChildren(ctx context.Context, flow *domain.Flow, parent
 			_ = catcher.Error("soar dispatch: record edge failed", err, map[string]any{"parent": parent.ID, "child": id})
 			continue
 		}
-		d.transitionChild(ctx, node, child)
+		d.transitionChild(ctx, node, parent, child)
 	}
 }
 
@@ -418,10 +418,10 @@ func (d *Dispatcher) markDeadBranches(ctx context.Context, flow *domain.Flow, pa
 	}
 }
 
-func (d *Dispatcher) transitionChild(ctx context.Context, node domain.FlowNode, child *domain.SoarExecution) {
-	contribs := []ParentContribution{{Context: child.Context}}
-	if child.Kind == domain.NodeKindEnrichment && len(child.Output) > 0 {
-		contribs = append(contribs, ParentContribution{EnrichmentNodeID: child.NodeID, Output: child.Output})
+func (d *Dispatcher) transitionChild(ctx context.Context, node domain.FlowNode, parent domain.SoarExecution, child *domain.SoarExecution) {
+	contribs := []ParentContribution{{Context: parent.Context}}
+	if parent.Kind == domain.NodeKindEnrichment && len(parent.Output) > 0 {
+		contribs = append(contribs, ParentContribution{EnrichmentNodeID: parent.NodeID, Output: parent.Output})
 	}
 	bag := MergeContexts(contribs)
 

frontend/src/features/soar/components/ExecutionsView.tsx

@@ -341,7 +341,7 @@ function nodeLabelOf(e: Execution, flow: Flow | undefined, t: TFunction) {
   if (e.origin === "FLOW" && e.nodeId)
     return [ancestorPath(e.nodeId, flow?.nodes ?? {}), e.nodeId]
       .filter(Boolean)
-      .join(" ← ");
+      .join(" -> ");
   return e.origin === "MANUAL" ? t("soar.executions.manual") : "—";
 }
 
@@ -514,7 +514,7 @@ function ancestorPath(
     chain.unshift(next);
     cur = next;
   }
-  return chain.join(" ← ");
+  return chain.join(" -> ");
 }
 
 function parentIds(id: string, nodes: Record<string, FlowNode>): string[] {

frontend/src/features/threat-intel/components/LookupBar.tsx

@@ -20,7 +20,11 @@ export function LookupBar({ onSearch, onLookup, isPending, isLookupPending }: Lo
 
   const handleSubmit = () => {
     const trimmed = q.trim()
-    if (!trimmed) return
+    if (!trimmed) {
+      // Empty lookup resets to the initial (un-narrowed) query.
+      onSearch('')
+      return
+    }
     if (selectedType === 'any') {
       onSearch(trimmed)
     } else {

frontend/src/features/threat-intel/hooks/use-ti-search-advanced.ts

@@ -6,11 +6,11 @@ import type { AdvancedSearchRequest } from '../domain/threat-intel.types'
 
 export function useTiSearchAdvanced() {
   return useMutation({
-    mutationFn: async (input: { body: AdvancedSearchRequest; limit?: number; page?: number }) =>{
+    mutationFn: async (input: { body: AdvancedSearchRequest; limit?: number; page?: number; fallback?: boolean }) =>{
       try{
         return await threatIntelHttpService.searchAdvanced(input.body, { limit: input.limit, page: input.page })
       }catch(e){
-        if(isNotFound(e)){
+        if(isNotFound(e) && input.fallback){
           const resp = await threatIntelHttpService.searchAdvanced({}, { limit: input.limit, page: input.page })
           resp.kind="empty"
           return resp

frontend/src/features/threat-intel/pages/ThreatIntelPage.tsx

@@ -107,10 +107,18 @@ export function ThreatIntelPage() {
     if (!observedFragment.ready) return
     const my = ++seqRef.current
     const mode = modeRef.current
-    const body = composeBody(filtersToRequest(filters), query, timeRange, observedFragment.fragment)
+    const filterRequest = filtersToRequest(filters)
+    const body = composeBody(filterRequest, query, timeRange, observedFragment.fragment)
     setLastBody(body)
+    // The generic corpus fallback is licensed only for the first, un-narrowed
+    // instance-IoC query. Any user-applied filter, text, lookup or time range
+    // that 404s means "no data for that query", not "serve the default".
+    const narrowed =
+      filterRequest.query !== undefined ||
+      query !== '*' ||
+      timeRange !== 'all'
     searchAdvancedMutation.mutate(
-      { body, limit: size, page: page + 1 },
+      { body, limit: size, page: page + 1, fallback: !narrowed },
       {
         onSuccess: (data) => {
           if (my !== seqRef.current) return
@@ -146,8 +154,9 @@ export function ThreatIntelPage() {
   const handleSearch = (q: string) => {
     modeRef.current = 'replace'
     setPage(0)
-    if (q === query) setBump((b) => b + 1)
-    else setQuery(q)
+    const next = q || '*'
+    if (next === query) setBump((b) => b + 1)
+    else setQuery(next)
   }
 
   const handlePageChange = (p: number) => {