luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Browse source 
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
This commit is contained in:
Luna 2026-07-24 09:59:09 -07:00
parent 1d1dee7f6e
commit d835386381
No known key found for this signature in database
43 changed files with 3419 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/SCHEMAS.md
View file

@ -139,6 +139,33 @@ Required fields:
| `hash_chain` | object | Local append-only hash-chain summary for snapshots and event logs: path, exists flag, record count, and last chain hash. |
| `read_only` | boolean | Always true for this dashboard API. |
## `enodia.go.sidecar.v1`
Status object returned by `/api/go-sidecar/status`, describing the optional,
separately configured Go migration-sidecar evidence tree (`go_sidecar_state_dir`).
This is a read-only view of another process's retained files: the Python web
process never starts, stops, or probes the Go sidecar, and this schema does not
appear anywhere in the production Python daemon's own state.
Required fields:
| Field | Type | Meaning |
|---|---|---|
| `schema` | string | `enodia.go.sidecar.v1`. |
| `read_only` | boolean | Always true. |
| `configured` | boolean | Whether `go_sidecar_state_dir` is set. |
| `state_dir` | string | The configured path, or `""` if unset. |
| `available` | boolean | Whether the configured directory currently exists. |
| `heartbeat` | object | `{"status": "not-configured"\|"missing"\|"fresh"\|"stale", ...}`; `fresh`/`stale` reports also include `timestamp`, `age_seconds`, and `max_age_seconds`. |
The related `/api/go-sidecar/alerts`, `/api/go-sidecar/incidents`, and
`/api/go-sidecar/events` endpoints replay the Go sidecar's own
`enodia.alert.snapshot.v1`, `enodia.incident.v1`, and `enodia.event.v1` records
after schema-checking each one; malformed or unrecognized files are dropped
(alerts/incidents) or reported as an explicit error rather than partially
displayed (events), so a damaged retained file cannot be misread as a clean
evidence stream.
## `enodia.hash_chain.v1`
JSONL record appended to `hash-chain.jsonl` when Sentinel captures forensic