feat(netflow-db): pin MAAD oracle to maad main @ b7bbb7d#109

ELI5

Updates our reference copy of the MAAD research code to the author's latest version and matches our Rust port to it.

Why

Upstream chris-misa/maad merged atomic-full-sortout into main and then fixed spectrum estimation (b7bbb7d). Our conformance oracle was pinned to an older commit.

What changes

• The documented oracle pin moves to maad main @ b7bbb7d, still with the one-line deltaQ = 1/8 patch. The oracle is the separately cloned upstream checkout described in docs/code/maad-conformance.md (/tmp/maad); the vendor/maad gitlink is unchanged by this PR.
• Dimension rows are ordered q = 0, 1, 2 and carry sd, as upstream. D1's sd is 0, meaning "not estimated".
• Spectrum port of b7bbb7d: compute the critical region (q_min, q_max) from τ, keep only α inside it, and treat equal consecutive α as still decreasing (tie tolerance 1e-12). The mixed fixture goes from 25 to 16 spectrum rows.
• Goldens regenerated; docs and fixtures README updated. MAAD contract and JSON schema versions bump, so pipeline databases with MAAD results must be regenerated as fresh products.

Review path

1. cargo test -p atlantis-netflow-db --test maad_conformance — all five fixtures pass against the regenerated goldens.

2. Optional oracle check: build the patched oracle per the guide, build Rust with ./scripts/build_maad_fast.sh, then run on a public fixture:

   sh

   1	python3 scripts/local/validate_maad.py \
   2	--rust target/release/netflow-db \
   3	--haskell /tmp/maad/MAAD \
   4	mixed=tools/netflow-db/tests/fixtures/maad-conformance/mixed/input.txt

   Expected: mixed: PASS total=128 prefixes=17 rows=structure:33,spectrum:16,dimensions:3 and exit code 0.

Edge cases and decisions

• --auto-stop, IPv6 input, and the new Hotelling T² / --compare-structure tests are not ported; none are part of the compared IPv4 output.
• Prefix selection, structure rows, and dimension values are unchanged; only spectrum filtering and dimension serialization change.
• On perfectly linear synthetic curves, Haskell's exact a1 >= a2 stops early on last-bit noise in τ while Rust keeps all tied rows. Goldens and real windows agree; the validator still requires exact row counts, so use inputs with real spectrum curvature.
• The oracle cannot produce JSON for empty, singleton, or fully filtered sets; Rust returns an empty result. These cases are excluded from conformance runs.

Verification

• Automated: bun run format, bun run lint, bun run typecheck, bun run test:db (includes maad_conformance).
• Validator: 25/25 IPv4 cases (5 public fixtures + 20 private real windows) pass against b7bbb7d.
• Validator on the public mixed fixture against a freshly built patched oracle (b7bbb7d + deltaQ = 1/8): output matched the expected line above, exit 0.
• Remaining manual verification: none required; the optional validator run above reproduces the oracle comparison.

Made by Claude Opus 5.5 (with Opus 5.5 subagents) via Claude Code.