fix(scope): expectation signatures structured output is not keyed like configured in contract output element

[antoinemzs]

Description

structured output sent as

{ "signatures" : { "targets".... } }

Contract output element is configured as

expectation_signature = ContractOutputElement(
    type=ContractOutputType.ExpectationSignature,
    field="expectation_signature",
    isMultiple=True,
    isFindingCompatible=False,
    labels=["scan"],
)

Environment

1. OS: { e.g. macOS 14, Windows 11, Ubuntu 22.04, etc. }
2. Version: { e.g. 1.2.3 }
3. Other environment details:

Reproducible steps

Steps to create the smallest reproducible scenario:

1. { e.g. Run ... }
2. { e.g. Click ... }
3. { e.g. Error ... }

Expected output

Actual output

Additional information

[DeniseMonreale]

An injector sends scan results with expectation signatures (Nmap, vulnerability scanner). The platform cannot match the signatures
against the expectations because the key is wrong → all injects show no result or uncertain state. Post-exercise reports show no detection signatures. The operator has no visibility on whether the control worked.

Fix: align the serialized key to the contract field declaration. The serializer should read the key from ContractOutputElement.field
rather than using a hardcoded string this prevents the same class of bug on other output elements.

Short term: fix "signatures" → "expectation_signature" in the serializer.Long term: enforce that all structured output builders derive their JSON keys from the ContractOutputElement.field value — no hardcoded strings.

[DeniseMonreale]

related to OpenAEV-Platform/openaev#855

[guzmud]

antoinemzs and Denise (@DeniseMonreale)

Regarding the field name signatures vs expectation_signature,

• isn't this more of an error in the injectors project PR (we wrongly used field="expectation_signature", and should amend the PRs for netexec, nmap and nuclei) and there is no need to change that in client-python
• or is the structured_output updated to replace signatures with expectation_signatures ? (unsure in that case if we still need to update the PRs to change from expectation_signature to expectation_signatures)

I see that there are others change in the PR, we can cherry-pick it / create a new one with the proper issues in github for

• the execution_status values (is there a reference for the values in the code ? we replicated the enum for execution_action since it was defined as InjectExecutionAction in Java, but execution_status seemed to be a plain String - this way we could add an Enum too in order to limit the values for execution status python-side)
• the change from complete to command_execution for the post_execution_update (we may need more information regarding the meaning of the values in InjectExecutionAction if post-execution the status should be command_execution rather than complete)

Short term: fix "signatures" → "expectation_signature" in the serializer.
Long term: enforce that all structured output builders derive their JSON keys from the ContractOutputElement.field value — no hardcoded strings.

Do you want us to open a different issue to remind us of the more long-term solution?