feat(go): report integrity anchor context

go-agent/internal/enrich/enrich.go

@@ -10,10 +10,12 @@ import (
 	"encoding/hex"
 	"io"
 	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"syscall"
+	"time"
 
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/netutil"
@@ -45,6 +47,7 @@ type Process struct {
 type SlowResult struct {
 	Processes map[int]map[string]any
 	Files     map[string]map[string]any
+	Integrity map[string]any
 }
 
 func CollectSlow(processes []Process, paths []string, owner ...func(string) string) SlowResult {
@@ -68,6 +71,31 @@ func CollectSlow(processes []Process, paths []string, owner ...func(string) stri
 	return result
 }
 
+// IntegrityAnchors reports durable state presence without running FIM, package
+// verification, or rootcheck on the alert path. Those engines stay disabled
+// until their own Go parity tranches land.
+func IntegrityAnchors(directory string) map[string]any {
+	return map[string]any{
+		"fim_baseline":   pathStatus(filepath.Join(directory, "fim-baseline.json")),
+		"pkgdb_anchor":   pathStatus(filepath.Join(directory, "pkgdb-anchor.json")),
+		"package_verify": map[string]any{"enabled": false, "sample": 0},
+		"rootcheck":      map[string]any{"enabled": false, "interval": 0},
+		"go_assurance":   pathStatus(filepath.Join(directory, "hash-chain.jsonl")),
+	}
+}
+
+func pathStatus(path string) map[string]any {
+	info, err := os.Stat(path)
+	if err != nil {
+		return map[string]any{"path": path, "status": "missing", "age": nil}
+	}
+	age := int64(time.Since(info.ModTime()).Seconds())
+	if age < 0 {
+		age = 0
+	}
+	return map[string]any{"path": path, "status": "present", "age": age}
+}
+
 func boundedHash(path string) any {
 	info, err := os.Stat(path)
 	if err != nil || !info.Mode().IsRegular() || info.Size() > MaxHashBytes {