trace/CONSISTENCY_ANALYSIS.md

Menu Interface Consistency Analysis

Summary

Investigation of key bindings and behavior across all views in the trace TUI application to identify inconsistencies and improve user experience.

Views in the Application

1. case_list - Main list of cases
2. case_detail - Case details with evidence list and case notes
3. evidence_detail - Evidence details with notes
4. tags_list - List of tags with usage counts
5. tag_notes_list - List of notes containing a specific tag
6. ioc_list - List of IOCs with usage counts
7. ioc_notes_list - List of notes containing a specific IOC
8. note_detail - Full view of a single note
9. help - Help screen

---

✅ What's CONSISTENT and Working Well

Global Keys (work everywhere)

• ? or h: Open help - Works from any view ✓
• q: Quit (or close help if in help view) ✓
• b: Back/navigate up hierarchy - Works consistently ✓
• Arrow keys: Navigate lists - Works consistently ✓

Navigation Pattern

• Enter: Consistently opens/selects items or dives deeper ✓
• b: Consistently goes back up the hierarchy ✓
• Hierarchy navigation is logical and predictable ✓

Note Actions in Main Views

• n: Add note - Works in case_list, case_detail, evidence_detail ✓
• Enter on note: Opens note_detail view - Now consistent across case_detail, evidence_detail, tag_notes_list, ioc_notes_list ✓
• v: View notes modal with highlight - Now consistent in case_detail and evidence_detail ✓

---

❌ INCONSISTENCIES Found

1. 'n' Key (Add Note) - Incomplete Coverage ⚠️

Issue: The 'n' key only works in case_list, case_detail, and evidence_detail.

Missing in:

• tags_list - Pressing 'n' does nothing useful
• tag_notes_list - Pressing 'n' does nothing useful
• ioc_list - Pressing 'n' does nothing useful
• ioc_notes_list - Pressing 'n' does nothing useful
• note_detail - Pressing 'n' does nothing useful
• help - (OK to not work here)

Expected behavior: User should be able to add notes from tag/IOC views since they're actively working with a case/evidence context.

Recommendation:

• Make 'n' work in tag_notes_list and ioc_notes_list by using the parent context (active_case or active_evidence)
• Consider whether it should work in tags_list and ioc_list as well
• In note_detail, 'n' could add a new note to the same context as the currently viewed note

Code location: trace/tui.py:2242 - dialog_add_note() only handles 3 views

---

2. 'a' Key (Set Active) - Incomplete Implementation ⚠️

Issue: The global handler key == ord('a') calls _handle_set_active(), but that method only handles:

• case_list
• case_detail
• evidence_detail

Missing in:

• tags_list - Could set active on the parent case/evidence
• tag_notes_list - Silent failure when pressed
• ioc_list - Could set active on the parent case/evidence
• ioc_notes_list - Silent failure when pressed
• note_detail - Silent failure when pressed

Expected behavior: Either the key should work (set active on the parent context) or show a message that it's not applicable.

Recommendation:

• Option A: Make 'a' work in tag/IOC list views by setting active on the parent case/evidence
• Option B: Show message "Not applicable in this view" when pressed in unsupported views
• Prefer Option A for consistency

Code location: trace/tui.py:1512 - _handle_set_active()

---

3. '/' Key (Filter) - Limited Availability ℹ️

Issue: Filter only works in case_list and case_detail.

Missing in:

• evidence_detail - Would be useful to filter notes!
• tags_list - Would be useful to filter tags
• tag_notes_list - Would be useful to filter notes
• ioc_list - Would be useful to filter IOCs
• ioc_notes_list - Would be useful to filter notes

Expected behavior: Users might expect to filter long lists of notes, tags, or IOCs.

Recommendation:

• High priority: Add filtering to evidence_detail (filter notes by content)
• Medium priority: Add filtering to tags_list, ioc_list (filter by name/value)
• Lower priority: Add filtering to tag_notes_list, ioc_notes_list (filter notes by content)

Code location: trace/tui.py:1236-1240 - Filter toggle only checks two views

---

4. 't' and 'i' Keys (Tags/IOCs) - Context-Dependent Availability ℹ️

Issue: These keys only work in case_detail and evidence_detail.

Current behavior: Silent no-op in other views

Expected behavior: This is actually reasonable - tags and IOCs are context-specific. However, it might be confusing when users press them in tag_notes_list or ioc_notes_list and nothing happens.

Recommendation:

• Low priority fix: Consider allowing 't' in ioc_notes_list to switch to tags view
• Low priority fix: Consider allowing 'i' in tag_notes_list to switch to IOCs view
• This would allow quick toggling between tag and IOC exploration
• Alternative: Show helpful message if pressed in unsupported views

Code location: trace/tui.py:1449-1452 - No view restrictions, but handlers at lines 182 and 206 check view

---

5. 'd' Key (Delete) - Incomplete Coverage ⚠️

Issue: Delete functionality is not implemented for all views where deletion makes sense.

Works in:

• case_list - Delete case ✓
• case_detail - Delete evidence or note ✓
• evidence_detail - Delete note ✓

Missing in:

• tag_notes_list - Could delete the selected note
• ioc_notes_list - Could delete the selected note
• note_detail - Could delete the currently viewed note

Expected behavior: Users viewing a note should be able to delete it from any view.

Recommendation:

• Add delete support for tag_notes_list and ioc_notes_list
• Add delete support for note_detail (delete current note and return to previous view)
• Be careful with confirmation dialogs to prevent accidental deletion

Code location: trace/tui.py:2331 - handle_delete() method

---

6. 'v' Key (View Notes Modal) - Limited Availability ℹ️

Issue: View notes modal only works in case_detail and evidence_detail.

Missing in:

• tag_notes_list - Could show all notes with the tag in a modal
• ioc_notes_list - Could show all notes with the IOC in a modal

Expected behavior: Might be nice to have a modal view option from tag/IOC note lists, but not critical since they're already list views.

Recommendation:

• Low priority: This might be redundant since tag_notes_list and ioc_notes_list are already list views
• Consider if there's a different modal that would be useful (e.g., showing just the tag/IOC highlights)

---

7. 'e' Key (Export) - Very Limited ℹ️

Issue: Export only works for IOCs in ioc_list and ioc_notes_list.

Missing export options:

• Export tags from tags_list
• Export notes from various views
• Export case summary from case_detail

Expected behavior: Users might expect export functionality for other data types.

Recommendation:

• Medium priority: Add 'e' to export tags from tags_list
• Lower priority: Consider export options for notes, cases, evidence

---

Priority Recommendations

High Priority (User expects it to work)

1. Fix 'n' (add note) in tag/IOC note lists - Users actively working with notes should be able to add new ones
2. Fix 'a' (set active) to work or give feedback - Silent failures are confusing
3. Add filtering to evidence_detail - Natural extension of existing filter functionality

Medium Priority (Nice to have)

4. Add delete support for tag/IOC note lists and note_detail - Complete the delete functionality
5. Add filter to tag and IOC lists - Helpful for large numbers of items
6. Make 't' and 'i' keys provide feedback - Better UX than silent failure

Low Priority (Edge cases)

7. Cross-navigation between tags and IOCs - Allow 't' in IOC views and 'i' in tag views
8. Export tags - Complement the export IOCs functionality

---

General Observations

Strengths

• Core navigation is very consistent (Enter, b, arrows)
• The hierarchy is logical and predictable
• Global keys work well everywhere
• Recent fixes made note navigation consistent ✓

Areas for Improvement

• Feature keys ('n', 'a', 'd', 't', 'i', 'v') should either work everywhere sensible OR provide clear feedback when not applicable
• Filtering could be more universally available
• Delete functionality should be available wherever items can be viewed
• Silent failures (pressing a key and nothing happening) should be minimized

---

Testing Recommendations

Create a testing matrix:

• Test each key in each view
• Document expected behavior
• Mark any silent failures
• Ensure error messages are helpful when actions aren't available