test(integration): demo-data drift — rename hardcoded 'host' → 'dest_host'

Root cause: commit 301dcd5 (chore(lookups): trim demo CSVs from 19 to 3
+ refactor refs) reduced lookups/rule_csv_map.csv from 9 mappings to
1 (DR55_brute_force_login → DR55_brute_force_users.csv). The
surviving CSV's columns are:

  user, src_ip, dest_host, threshold, auth_method, Comment,
  Expires, _added_by, _added_at

— no plain "host" column. Integration tests that call mapping[0]
and then submit a column_removal/approval request for column "host"
fail at approval-replay time with:

  {"error": "Column 'host' no longer exists",
   "request_id": "..."}

The error message is honest — "host" never existed in that CSV.
DR130_priv_escalation.csv (which DOES have a "host" column) is no
longer in the demo mapping after the trim.

Sites changed (all read from mapping[0] and hardcoded "host"):

  tests/integration/test_approval_workflow.py:97 (default kwarg)
  tests/integration/test_approval_workflow.py:463-464
  tests/integration/test_audit_emission.py:197-198
  tests/integration/test_audit_emission.py:267-268
  tests/integration/test_notification_payload.py:115-116
  tests/integration/test_post_happy_paths.py:467-472 (helper
    _submit_column_removal)
  tests/integration/test_post_happy_paths.py:517-522
    (test_approve_response_shape_for_column_removal — the only
    FAILED test on each run; the SKIPPED tests in
    test_limit_edge_cases.py and test_notification_payload.py
    call helpers that depend on this path)

Sites left as "host" (test creates its own CSV via headers=["host"]
— self-contained, no dependency on demo state):

  tests/integration/test_post_error_paths.py:83 / 99 / 122 (CSV
    creation tests — these CREATE a CSV with header "host")
  tests/integration/test_post_happy_paths.py:685 / 690 (bulk-row
    submit test; the submit endpoint does not validate row-column
    existence so this passes regardless)

Independent evidence: 5 consecutive failed Integration Tests runs
(26307468975 / 26293782287 / 26293068253 / 26292468446 /
26292308961) all surfaced the SAME single FAILED line in the same
test, deterministic across commits b14b3c9 / 91d9d22 / ab53066 /
a48f6c2 / 4330149.

Verification path: next Integration Tests run on main should show
1 fewer failure (target = 0 failed, 357 passed instead of the
prior 1 failed, 356 passed). The 3 skips traced to the same root
cause should also resolve (the test_limit_edge_cases.py skip on
"Rate limit exceeded" is a separate issue — see follow-up).

Author: RelativisticJet

tests/integration/test_approval_workflow.py

@@ -94,7 +94,7 @@ def _read_queue_via_get(container_curl) -> list:
 
 def _submit_column_removal_request(
         container_curl, csv_file: str, rule_name: str,
-        column_name: str = "host",
+        column_name: str = "dest_host",
         description: str = "Ring 1 test - test column removal request",
         comment: str = "Ring 1 test - column deprecated") -> dict:
     """Submit a column_removal approval request and return the
@@ -460,8 +460,8 @@ def test_non_ascii_description_returns_400(
             "app_context": "wl_manager",
             "description": "Reason with unicode: 中文",
             "pending_highlight": {"type": "column",
-                                  "column_name": "host"},
-            "payload": {"column_name": "host"},
+                                  "column_name": "dest_host"},
+            "payload": {"column_name": "dest_host"},
         })
         assert "error" in body, \
             f"non-ASCII description should be rejected: {body}"

tests/integration/test_audit_emission.py

@@ -194,8 +194,8 @@ def test_request_submitted_event_has_full_schema(
                 "description": description,
                 "comment": f"Audit schema test {marker}",
                 "pending_highlight": {"type": "column",
-                                      "column_name": "host"},
-                "payload": {"column_name": "host"},
+                                      "column_name": "dest_host"},
+                "payload": {"column_name": "dest_host"},
             }, user="analyst1")
 
         if "error" in body:
@@ -264,8 +264,8 @@ def test_request_rejected_event_has_full_schema(
                 "description": f"Ring1reject_{marker}",
                 "comment": "test",
                 "pending_highlight": {"type": "column",
-                                      "column_name": "host"},
-                "payload": {"column_name": "host"},
+                                      "column_name": "dest_host"},
+                "payload": {"column_name": "dest_host"},
             }, user="analyst1")
         if "error" in submit_body:
             pytest.skip(f"submit failed: {submit_body}")

tests/integration/test_notification_payload.py

@@ -112,8 +112,8 @@ def _submit_column_removal(container_curl, csv_file, rule_name,
         "app_context": "wl_manager",
         "description": "Ring 2 Day 2 notification payload test",
         "comment": comment,
-        "pending_highlight": {"type": "column", "column_name": "host"},
-        "payload": {"column_name": "host"},
+        "pending_highlight": {"type": "column", "column_name": "dest_host"},
+        "payload": {"column_name": "dest_host"},
     }, user=user)
 
 

tests/integration/test_post_happy_paths.py

@@ -465,11 +465,11 @@ def _submit_column_removal(container_curl, csv_file, rule_name):
         "description": "Ring 1 day 3 test",
         "comment": "Ring 1 day 3 test reason",
         "pending_highlight": {"type": "column",
-                              "column_name": "host"},
+                              "column_name": "dest_host"},
         "payload": {
-            "column_name": "host",
+            "column_name": "dest_host",
             "column_removal_reasons": [
-                {"column": "host", "reason": "Ring 1 test"},
+                {"column": "dest_host", "reason": "Ring 1 test"},
             ],
         },
     }
@@ -515,11 +515,11 @@ def test_approve_response_shape_for_column_removal(
             "description": "Ring 1 day 3 approve-flow test",
             "comment": "Ring 1 day 3 approve-flow reason",
             "pending_highlight": {"type": "column",
-                                  "column_name": "host"},
+                                  "column_name": "dest_host"},
             "payload": {
-                "column_name": "host",
+                "column_name": "dest_host",
                 "column_removal_reasons": [
-                    {"column": "host", "reason": "Ring 1 test"}
+                    {"column": "dest_host", "reason": "Ring 1 test"}
                 ],
             },
         })