SparkForensics

Appearance

Detector catalog / Setup

INCMP

Incomplete run

The event log ends before the application did, so every number is a partial view.

Outcome
Setup
Scope
Judged on the whole run
Usual fix
A change in the job code
CI gate
No budget flag: gate it with --fail-on-introduced against a baseline

An example finding

Where you see it

Dashboard

The INCMP tag marks it in the action region of the dashboard, among the widgets that rank a fix. How to read it in the findings guide.

Agent (MCP)

An assistant can read this entry with the list_detectors tool and its background with get_finding_documentation. The call and the response below come from a real run of the MCP server.

Call

{
  "tool": "list_detectors",
  "arguments": {
    "type": "incompleteRun"
  }
}

Response

{
  "count": 1,
  "detectors": [
    {
      "type": "incompleteRun",
      "name": "incomplete run",
      "tag": "INCMP",
      "tagSharedWith": [],
      "family": "setup",
      "pitch": "The event log ends before the application did, so every number is a partial view.",
      "region": "action",
      "scope": "app",
      "fixEffort": "code",
      "thresholdSummary": "an event log missing its terminal ApplicationEnd event",
      "detectors": [
        {
          "detector": "incompleteRun",
          "version": 1,
          "thresholds": {}
        }
      ],
      "pages": {
        "catalog": "docs/detectors/incompleteRun.html",
        "guide": "docs/user-guide/understanding-findings.html#incmp"
      },
      "tuning": null,
      "gate": null
    }
  ]
}

get_finding_documentation call

{
  "tool": "get_finding_documentation",
  "arguments": {
    "type": "incompleteRun"
  }
}

Its response, with each Markdown body replaced by its length

{
  "type": "incompleteRun",
  "name": "Incomplete Run",
  "detectionDoc": {
    "tag": "INCMP",
    "title": "Incomplete run",
    "content": "<311 characters of Markdown>"
  },
  "tuningDoc": null
}

CI (CLI)

List this entry from the command line. The output below is a real run of the command. Budgets and exit codes are in the CI guide. 

sparkforensics-analyze detectors --type incompleteRun --format md
# Detectors (1)

## Setup

| Tag | Type | Scope | Fix | Gate | What it finds |
| --- | --- | --- | --- | --- | --- |
| INCMP | `incompleteRun` | app | code |  | The event log ends before the application did, so every number is a partial view. |

Report only this finding type for a run with --type:

sparkforensics-analyze <event-log> --type incompleteRun --impact critical,warning,info

It has no budget flag. Fail a build on a new one by comparing against a baseline with --fail-on-introduced.

Airflow

The operator has no budget parameter for it. Use fail_on_introduced with a baseline.

check_spark_job = SparkForensicsOperator(
    task_id="check_spark_job",
    log_source=...,
    backend=SubprocessAnalyzeHook(),
    baseline_log_source=...,
    fail_on_introduced="critical",
)

The operator works per run, and its summary counts findings per impact band. See the operator for its parameters.

How it is measured

Thresholds

An event log missing its terminal ApplicationEnd event.

incompleteRun version 1

ThresholdDefault
No thresholds.

Each rule's impact bands and fixed fallbacks are in the threshold tables.

Override a default per run with --thresholds; see Tuning detector thresholds.

Docs