stage-14: pytest test suite over the worker lines

38 tests covering the pure worker-line logic: Classifyline rules, Routeline
TLP/country/incident-type gates, Sealine seal/unseal round-trip, Proofline
confidence scoring, Mapline CVEResolver escalation, Trainline dataset
well-posedness (the v1/v3 input-signal bugs are now regression-guarded), and
the Scoutline feed parsers. pytest added as a dev extra.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_map.py

@@ -0,0 +1,42 @@
+"""Mapline tests — CVEResolver KEV cross-check."""
+
+from __future__ import annotations
+
+from psyc.lines.map import _looks_like_ip, kev_cve_set, resolve_cves
+from psyc.models import Severity
+from conftest import make_case
+
+
+def test_kev_cve_set_only_from_kev_cases():
+    kev = make_case(feed="cisa-kev", cves=["CVE-2026-0001"])
+    urlhaus = make_case(feed="urlhaus", cves=["CVE-2099-9999"])  # not KEV-sourced
+    assert kev_cve_set([kev, urlhaus]) == {"CVE-2026-0001"}
+
+
+def test_resolve_cves_flags_and_escalates_non_kev_case():
+    kev_set = {"CVE-2026-0001"}
+    case = make_case(feed="urlhaus", cves=["CVE-2026-0001"], severity=Severity.LOW)
+    resolve_cves(case, kev_set)
+    assert case.source_metadata["kev_cves"] == "CVE-2026-0001"
+    assert case.classification.severity is Severity.HIGH
+
+
+def test_resolve_cves_does_not_escalate_kev_source_case():
+    kev_set = {"CVE-2026-0001"}
+    case = make_case(feed="cisa-kev", cves=["CVE-2026-0001"], severity=Severity.LOW)
+    resolve_cves(case, kev_set)
+    # its own CVE is in KEV by definition — no self-escalation
+    assert case.classification.severity is Severity.LOW
+
+
+def test_resolve_cves_noop_without_match():
+    case = make_case(feed="urlhaus", cves=["CVE-2099-9999"], severity=Severity.MEDIUM)
+    resolve_cves(case, {"CVE-2026-0001"})
+    assert "kev_cves" not in case.source_metadata
+    assert case.classification.severity is Severity.MEDIUM
+
+
+def test_looks_like_ip():
+    assert _looks_like_ip("8.8.8.8")
+    assert not _looks_like_ip("example.com")
+    assert not _looks_like_ip("999.1.1.1")