[Prasad-desh]

Fixes #119
Fixes #120

_validate_config skipped the type check when prohibited_keywords or prohibited_indicators was None, so a config carrying the key with an empty YAML value started up clean. check_event then reads the key back with .get(key, DEFAULT), which returns None rather than the default once the key is present, and raises TypeError on the first matching event. The detector is down for the rest of the process after that, so a prohibited vendor re-activated later goes unflagged.

Checking for the key's presence instead, as both issues suggest.

gradual_status_flip.py has the same validator and the same read-back and no issue filed against it, so it is fixed here too. All three confirmed accepting None before the change:

PolicyBypassNonCompliantDetector: config.get("prohibited_keywords", DEFAULT)   -> None
VendorStatusFlipDetector:         config.get("prohibited_indicators", DEFAULT) -> None
GradualStatusFlipDetector:        config.get("prohibited_indicators", DEFAULT) -> None

The three negative tests fail on main and pass with the fix. tests/unit/ctf is 42 passed, 1 skipped before and after.

The tests are in a new file rather than tests/unit/ctf/test_detectors.py, since #136 adds that file with its own TestNegativeCases and the two would collide. The test IDs the issues name are kept as they are so the mapping is still obvious.

One thing left out on purpose: invoice_threshold_bypass.py and invoice_trust_override.py validate max_invoice_amount and min_amount the same way and read them back with a default, so an explicit None gets past startup there too. Happy to open a separate issue for those if that is useful.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.