refactor(tests): merge detect_suggested_procedure into expected_detection

Two overlapping TestTemplate fields (expected_detection: narrative
guidance from imports/leads; detect_suggested_procedure: concrete
commands from approved suggestions) are now one. Blue-side procedure
suggestions target expected_detection directly, appending onto
whatever is already there rather than overwriting it — same
merge-not-overwrite behavior already used for the red side. Existing
detect_suggested_procedure data is folded into expected_detection
before the column is dropped.

backend/app/models/test_template.py

@@ -41,13 +41,12 @@ class TestTemplate(Base):
     source_url = Column(String, nullable=True)
     # Assign attack_procedure = Column(Text, nullable=True)               # Suggested attack procedure
     attack_procedure = Column(Text, nullable=True)               # Suggested attack procedure
-    # Assign expected_detection = Column(Text, nullable=True)             # What blue team should detect
-    expected_detection = Column(Text, nullable=True)             # What blue team should detect
-    # Suggested detection procedure — Blue's counterpart to attack_procedure.
-    # Only ever filled in via an approved procedure suggestion or a lead
-    # editing the template directly; external syncs never touch it (those
-    # only insert brand-new rows, never update existing ones).
-    detect_suggested_procedure = Column(Text, nullable=True)
+    # What blue team should detect — narrative guidance from imports/leads,
+    # plus concrete commands appended via approved procedure suggestions
+    # (Blue's counterpart to attack_procedure). External syncs never touch
+    # an existing row (they only insert brand-new ones), so anything added
+    # here is safe across re-syncs.
+    expected_detection = Column(Text, nullable=True)
     # Assign platform = Column(String, nullable=True)                     # windows / linux...
     platform = Column(String, nullable=True)                     # windows / linux / macos
     # Assign tool_suggested = Column(String, nullable=True)

backend/app/routers/procedure_suggestions.py

@@ -52,7 +52,7 @@ def _to_out(suggestion, template_by_id: dict) -> ProcedureSuggestionOut:
     if template is not None:
         out.template_name = template.name
         out.template_current_text = (
-            template.attack_procedure if suggestion.team == "red" else template.detect_suggested_procedure
+            template.attack_procedure if suggestion.team == "red" else template.expected_detection
         )
     return out
 

backend/app/schemas/test_template.py

@@ -31,7 +31,6 @@ class TestTemplateOut(BaseModel):
     attack_procedure: str | None = None
     # Assign expected_detection = None
     expected_detection: str | None = None
-    detect_suggested_procedure: str | None = None
     # Assign platform = None
     platform: str | None = None
     # Assign tool_suggested = None
@@ -71,7 +70,6 @@ class TestTemplateCreate(BaseModel):
     attack_procedure: str | None = None
     # Assign expected_detection = None
     expected_detection: str | None = None
-    detect_suggested_procedure: str | None = None
     # Assign platform = None
     platform: str | None = None
     # Assign tool_suggested = None

backend/app/services/procedure_suggestion_service.py

@@ -28,7 +28,7 @@ from app.services.procedure_extraction_service import extract_commands
 # Which Test field holds the operator's free-text procedure, and which
 # TestTemplate field it's proposed as an improvement to, per team.
 _SOURCE_FIELD = {"red": "procedure_text", "blue": "detect_procedure"}
-_TEMPLATE_FIELD = {"red": "attack_procedure", "blue": "detect_suggested_procedure"}
+_TEMPLATE_FIELD = {"red": "attack_procedure", "blue": "expected_detection"}
 _LEAD_ROLE = {"red": "red_lead", "blue": "blue_lead"}
 
 

backend/app/services/test_crud_service.py

@@ -364,7 +364,7 @@ def create_test_from_template(
         platform=platform_override if platform_override is not None else template.platform,
         procedure_text=procedure_text_override if procedure_text_override is not None else template.attack_procedure,
         tool_used=tool_used_override if tool_used_override is not None else template.tool_suggested,
-        detect_procedure=template.detect_suggested_procedure,
+        detect_procedure=template.expected_detection,
         remediation_steps=template.suggested_remediation,
         # Keyword argument: created_by
         created_by=creator_id,