Ship only the integration and its README

Drop test_dedup.py from the integration folder: the deliverable is the
script and its documentation. The window rules it asserted are now a
documented manual procedure instead, ageing first_seen with sqlite3 so
both the no-slide and the rollover behaviour can be confirmed in seconds
rather than over a day.

Also round the window_age_h helper query, which truncated a 23 hour old
anchor to 22.

Author: leonfullxr

integrations/vulnerability_email_dedup/README.md

@@ -126,15 +126,14 @@ graph TD
 
 #### Using the Integration Files
 
-This integration ships three files:
+This integration ships two files:
 
 | File | Purpose |
 | --- | --- |
 | `custom-email.py` | The integration logic. |
 | `custom-email` | Standard Wazuh shell wrapper that invokes the script with the embedded Python interpreter. |
-| `test_dedup.py` | Self-check for the window logic. Not deployed to the manager. |
 
-Copy the two runtime files to the manager:
+Copy both to the manager:
 
 ```bash
 cp custom-email custom-email.py /var/ossec/integrations/
@@ -152,8 +151,8 @@ chown root:wazuh /var/ossec/integrations/custom-email*
 #### Script Configuration
 
 Edit the configuration block at the top of `custom-email.py`. Every value also
-accepts an environment variable override, which is how the test harness
-redirects mail and storage into a sandbox without editing the file.
+accepts an environment variable override, so mail and storage can be redirected
+into a sandbox for testing without editing the deployed file.
 
 | Setting | Environment variable | Default | Description |
 | --- | --- | --- | --- |
@@ -291,29 +290,7 @@ seen package or records the CVE and exits silently.
 
 ### Integration Testing
 
-#### Test 1: Window logic self-check
-
-Run the bundled self-check from the integration directory. It exercises the
-window rules against a temporary database, sends no mail, and needs nothing
-outside the standard library:
-
-```bash
-python3 test_dedup.py
-```
-
-Expected:
-
-```
-OK: all de-duplication window checks passed
-```
-
-It asserts the behaviours that would otherwise take a day of wall-clock time to
-observe: that a burst of 1,000 alerts for one package produces exactly one
-email with no lost counts, that a flood arriving inside the window neither
-notifies nor moves the anchor, that the next alert after the window elapses
-notifies and re-anchors, and that prune removes only fully elapsed rows.
-
-#### Test 2: First alert for a package sends an email
+#### Test 1: First alert for a package sends an email
 
 Write a sample alert and invoke the script directly:
 
@@ -343,7 +320,7 @@ Expected:
 2026-07-18T10:00:01 INFO Sent vuln alert package=openssl agent=001 cve=CVE-2026-0001
 ```
 
-#### Test 3: A second CVE for the same package is suppressed
+#### Test 2: A second CVE for the same package is suppressed
 
 ```bash
 sed 's/CVE-2026-0001/CVE-2026-0002/g' /tmp/alert1.json > /tmp/alert2.json
@@ -356,7 +333,7 @@ default `INFO` level. The row instead shows the incremented count:
 ```bash
 sqlite3 /var/ossec/logs/vuln_dedup.db \
   "SELECT agent_id, package, status, cve_count,
-          CAST((strftime('%s','now') - first_seen) / 3600 AS INT) AS window_age_h
+          CAST(ROUND((strftime('%s','now') - first_seen) / 3600.0) AS INT) AS window_age_h
    FROM dedup;"
 ```
 
@@ -367,7 +344,7 @@ alert did not move it:
 001|openssl|Active|2|0
 ```
 
-#### Test 4: Burst behaviour and concurrency
+#### Test 3: Burst behaviour and concurrency
 
 Generate a burst of alerts for a handful of packages and confirm that no update
 is lost. The invariant to check is that the sum of `cve_count` across all rows
@@ -383,19 +360,66 @@ sqlite3 /var/ossec/logs/vuln_dedup.db \
   "SELECT agent_id, package, status, cve_count FROM dedup ORDER BY cve_count DESC LIMIT 10;"
 ```
 
+#### Test 4: Window rollover, without waiting 24 hours
+
+The two rules worth confirming are that the window does not slide, and that it
+reopens 24 hours after the **first** alert. Both can be checked immediately by
+ageing the row's anchor by hand instead of waiting.
+
+First, prove the window does not slide. Age the anchor to 23 hours old, replay
+an alert, and re-read the anchor:
+
+```bash
+sqlite3 /var/ossec/logs/vuln_dedup.db \
+  "UPDATE dedup SET first_seen = first_seen - 23*3600 WHERE package='openssl';"
+
+sudo -u wazuh /var/ossec/integrations/custom-email /tmp/alert2.json
+
+sqlite3 /var/ossec/logs/vuln_dedup.db \
+  "SELECT cve_count,
+          CAST(ROUND((strftime('%s','now') - first_seen) / 3600.0) AS INT) AS window_age_h
+   FROM dedup WHERE package='openssl';"
+```
+
+No email is sent, and `window_age_h` is still `23`. The count rose but the
+anchor did not move, so replaying more alerts can never push the window
+forward.
+
+Now age it past the window and replay again:
+
+```bash
+sqlite3 /var/ossec/logs/vuln_dedup.db \
+  "UPDATE dedup SET first_seen = first_seen - 2*3600 WHERE package='openssl';"
+
+sudo -u wazuh /var/ossec/integrations/custom-email /tmp/alert2.json
+tail -n 1 /var/ossec/logs/custom-email_integration.log
+```
+
+A fresh email is sent and the row re-anchors, so `cve_count` returns to `1` and
+`window_age_h` to `0`:
+
+```
+2026-07-18T10:10:00 INFO Sent vuln alert package=openssl agent=001 cve=CVE-2026-0002
+```
+
 #### Test 5: Maintenance mode
 
 ```bash
 sudo -u wazuh /var/ossec/integrations/custom-email prune
 tail -n 1 /var/ossec/logs/custom-email_integration.log
 ```
 
-Expected, since the rows just created are still inside their window:
+Expected, since the row was just re-anchored and is inside its window:
 
 ```
-2026-07-18T10:05:00 INFO Prune complete: removed 0 elapsed row(s).
+2026-07-18T10:15:00 INFO Prune complete: removed 0 elapsed row(s).
 ```
 
+Age it past the window again and prune removes it, which is the housekeeping
+path. Removing an elapsed row changes no behaviour: the next alert for that
+package simply creates a new row and sends one email, exactly as an elapsed row
+would have.
+
 ---
 
 ### Troubleshooting
@@ -420,8 +444,8 @@ Expected, since the rows just created are still inside their window:
 - **Adapted by**: Leon Fuller.
 - **Tested versions**: Wazuh manager 4.x with Vulnerability Detection enabled
   and the 4.8+ vulnerability alert schema. Python 3 standard library only, no
-  third-party dependencies. Logic validated on Python 3.11 by the bundled
-  `test_dedup.py`, plus a synthetic 2,000-alert burst at 64-way concurrency: 300
+  third-party dependencies. Logic validated on Python 3.11: the window rules
+  above, plus a synthetic 2,000-alert burst at 64-way concurrency, where 300
   distinct keys produced 300 emails, `SUM(cve_count)` matched the 2,000 alerts
   fed in, and no lock errors occurred.
 - **Maintainer**: Leon Fuller.