feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

go-agent/internal/pkgdb/manager.go

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package pkgdb
+
+import (
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+// Manager owns the slow package-database fingerprint outside the polling path.
+// One check runs at a time; an unavailable pacman database or log fails open
+// rather than turning an environmental read error into a tamper claim.
+type Manager struct {
+	Config          config.Config
+	Now             func() time.Time
+	Fingerprint     func(string) (string, error)
+	LastTransaction func(string) (time.Time, bool)
+	DBDir           string
+	PacmanLog       string
+
+	mu            sync.Mutex
+	initialized   bool
+	lastRun       time.Time
+	running       bool
+	pendingAlerts []model.Alert
+}
+
+func New(cfg config.Config) *Manager {
+	return &Manager{
+		Config: cfg, Now: time.Now, Fingerprint: Fingerprint,
+		LastTransaction: LastTransactionTime, DBDir: defaultDBDir, PacmanLog: defaultPacmanLog,
+	}
+}
+
+func (m *Manager) anchorPath() string {
+	return filepath.Join(m.Config.LogDir, anchorFilename)
+}
+
+// Initialize records the first available fingerprint synchronously. This is a
+// one-time baseline action before events are emitted; subsequent checks stay
+// asynchronous and never rewrite unexplained drift.
+func (m *Manager) Initialize() error {
+	if !m.Config.PackageDBVerify {
+		return nil
+	}
+	m.mu.Lock()
+	if m.initialized {
+		m.mu.Unlock()
+		return nil
+	}
+	m.mu.Unlock()
+	if err := os.MkdirAll(m.Config.LogDir, 0o750); err != nil {
+		return err
+	}
+	if err := m.evaluate(m.Now()); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	m.initialized = true
+	m.mu.Unlock()
+	return nil
+}
+
+// MaybeStart starts a due fingerprint in the background. Setting lastRun
+// before launching makes a stalled disk scan self-throttling instead of
+// spawning one goroutine per polling interval.
+func (m *Manager) MaybeStart(now time.Time) {
+	if !m.Config.PackageDBVerify {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if !m.initialized || m.running || (!m.lastRun.IsZero() && now.Sub(m.lastRun) < m.Config.PackageDBInterval) {
+		return
+	}
+	m.running, m.lastRun = true, now
+	go m.run(now)
+}
+
+func (m *Manager) run(now time.Time) {
+	_ = m.evaluate(now) // Collection errors are intentionally fail-open.
+	m.mu.Lock()
+	m.running = false
+	m.mu.Unlock()
+}
+
+func (m *Manager) evaluate(now time.Time) error {
+	current, err := m.Fingerprint(m.DBDir)
+	if err != nil {
+		return nil
+	}
+	anchor, hasAnchor := loadAnchor(m.anchorPath())
+	transaction, hasTransaction := m.LastTransaction(m.PacmanLog)
+	alert, replacement := check(current, anchor, hasAnchor, transaction, hasTransaction, now)
+	if replacement != nil {
+		if err := saveAnchor(m.anchorPath(), *replacement); err != nil {
+			return err
+		}
+	}
+	if alert != nil {
+		m.mu.Lock()
+		m.pendingAlerts = append(m.pendingAlerts, *alert)
+		m.mu.Unlock()
+	}
+	return nil
+}
+
+// Drain hands completed findings to Agent, which applies the shared cooldown,
+// snapshot, and event-stream ordering before any finding becomes observable.
+func (m *Manager) Drain() []model.Alert {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	alerts := append([]model.Alert(nil), m.pendingAlerts...)
+	m.pendingAlerts = nil
+	return alerts
+}

go-agent/internal/pkgdb/pkgdb.go

@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package pkgdb ports Sentinel's layer-one pacman database tamper evidence.
+// It does not treat the mutable local database as a root of trust: it records
+// a baseline fingerprint, permits only transaction-correlated change, and
+// retains the old anchor when a change is unexplained.
+package pkgdb
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+const (
+	SIDTamper        = 100021
+	defaultDBDir     = "/var/lib/pacman/local"
+	defaultPacmanLog = "/var/log/pacman.log"
+	anchorFilename   = "pkgdb-anchor.json"
+	transactionSlop  = 120 * time.Second
+)
+
+// Anchor is deliberately compatible with Python's small JSON record. Time is
+// an epoch value so both implementations can compare it with pacman's log
+// timestamp without formatting or local-time ambiguity.
+type Anchor struct {
+	Fingerprint string  `json:"fingerprint"`
+	Time        float64 `json:"time"`
+}
+
+// Fingerprint computes the deterministic SHA-256 used for the local package
+// database. It reads each non-directory entry in lexical walk order; a read
+// failure makes the whole check unavailable rather than producing a partial
+// fingerprint that could become an unsafe new baseline.
+func Fingerprint(directory string) (string, error) {
+	hash := sha256.New()
+	err := filepath.WalkDir(directory, func(path string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		if _, err := io.WriteString(hash, path+"\x00"); err != nil {
+			return err
+		}
+		file, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		_, copyErr := io.Copy(hash, file)
+		closeErr := file.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		return closeErr
+	})
+	if err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+// LastTransactionTime returns the final pacman transaction marker. A missing
+// or unparseable log is intentionally inconclusive; it is never treated as a
+// successful transaction that could authorize a changed database.
+func LastTransactionTime(path string) (time.Time, bool) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return time.Time{}, false
+	}
+	var latest time.Time
+	for _, line := range strings.Split(string(raw), "\n") {
+		if !strings.Contains(line, "transaction completed") && !strings.Contains(line, "transaction started") {
+			continue
+		}
+		end := strings.IndexByte(line, ']')
+		if !strings.HasPrefix(line, "[") || end < 2 {
+			continue
+		}
+		stamp := line[1:end]
+		for _, layout := range []string{time.RFC3339, "2006-01-02T15:04:05-0700"} {
+			if parsed, err := time.Parse(layout, stamp); err == nil {
+				latest = parsed
+				break
+			}
+		}
+	}
+	return latest, !latest.IsZero()
+}
+
+func tamperAlert() model.Alert {
+	return model.Alert{
+		SID: SIDTamper, Severity: "CRITICAL", Signature: "pkgdb_tamper",
+		Classtype: "anti-tamper", Key: "pkgdb:tamper", PIDs: []int{},
+		Detail: "pacman local DB changed with no corresponding transaction — the package checksum database may have been altered to mask file tampering",
+	}
+}
+
+func loadAnchor(path string) (Anchor, bool) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return Anchor{}, false
+	}
+	var anchor Anchor
+	if err := json.Unmarshal(raw, &anchor); err != nil || anchor.Fingerprint == "" || anchor.Time <= 0 {
+		return Anchor{}, false
+	}
+	return anchor, true
+}
+
+func saveAnchor(path string, anchor Anchor) error {
+	raw, err := json.Marshal(anchor)
+	if err != nil {
+		return err
+	}
+	raw = append(raw, '\n')
+	temporary := path + ".tmp"
+	if err := os.WriteFile(temporary, raw, 0o640); err != nil {
+		return err
+	}
+	if err := os.Rename(temporary, path); err != nil {
+		return err
+	}
+	return os.Chmod(path, 0o640)
+}
+
+// check returns an alert only for changed state that no later pacman
+// transaction can explain. It deliberately returns a replacement anchor only
+// for first observation or a transaction-correlated change.
+func check(current string, anchor Anchor, hasAnchor bool, transaction time.Time, hasTransaction bool, now time.Time) (*model.Alert, *Anchor) {
+	if !hasAnchor {
+		fresh := Anchor{Fingerprint: current, Time: float64(now.Unix())}
+		return nil, &fresh
+	}
+	if current == anchor.Fingerprint {
+		return nil, nil
+	}
+	if hasTransaction && !transaction.Before(time.Unix(int64(anchor.Time), 0).Add(-transactionSlop)) {
+		fresh := Anchor{Fingerprint: current, Time: float64(now.Unix())}
+		return nil, &fresh
+	}
+	alert := tamperAlert()
+	return &alert, nil
+}

go-agent/internal/pkgdb/pkgdb_test.go

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package pkgdb
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+)
+
+func write(t *testing.T, path, contents string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(contents), 0o640); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestFingerprintIsDeterministicAndChangesWithContent(t *testing.T) {
+	directory := t.TempDir()
+	write(t, filepath.Join(directory, "b", "desc"), "second")
+	write(t, filepath.Join(directory, "a", "desc"), "first")
+	first, err := Fingerprint(directory)
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := Fingerprint(directory)
+	if err != nil || first != again {
+		t.Fatalf("fingerprints %q %q err=%v", first, again, err)
+	}
+	write(t, filepath.Join(directory, "a", "desc"), "changed")
+	changed, err := Fingerprint(directory)
+	if err != nil || changed == first {
+		t.Fatalf("changed fingerprint %q original %q err=%v", changed, first, err)
+	}
+}
+
+func TestLastTransactionTimeAcceptsPacmanTimestampLayouts(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pacman.log")
+	write(t, path, "[2026-07-24T10:00:00-0700] [ALPM] transaction started\n[2026-07-24T10:01:00-07:00] [ALPM] transaction completed\n")
+	got, ok := LastTransactionTime(path)
+	if !ok || got.Format(time.RFC3339) != "2026-07-24T10:01:00-07:00" {
+		t.Fatalf("transaction=%v ok=%v", got, ok)
+	}
+}
+
+func TestManagerPreservesUnexplainedChangedAnchorAndAcceptsTransaction(t *testing.T) {
+	directory := t.TempDir()
+	database := filepath.Join(directory, "pacman-db")
+	write(t, filepath.Join(database, "pkg", "desc"), "trusted")
+	cfg := config.Default()
+	cfg.LogDir = filepath.Join(directory, "state")
+	manager := New(cfg)
+	manager.DBDir = database
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	manager.Now = func() time.Time { return now }
+	manager.LastTransaction = func(string) (time.Time, bool) { return time.Time{}, false }
+	if err := manager.Initialize(); err != nil {
+		t.Fatal(err)
+	}
+	initial, ok := loadAnchor(manager.anchorPath())
+	if !ok {
+		t.Fatal("missing initial anchor")
+	}
+	write(t, filepath.Join(database, "pkg", "desc"), "tampered")
+	if err := manager.evaluate(now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	alerts := manager.Drain()
+	if len(alerts) != 1 || alerts[0].SID != SIDTamper || alerts[0].Severity != "CRITICAL" {
+		t.Fatalf("alerts=%+v", alerts)
+	}
+	afterTamper, _ := loadAnchor(manager.anchorPath())
+	if afterTamper.Fingerprint != initial.Fingerprint {
+		t.Fatal("unexplained change silently replaced anchor")
+	}
+	manager.LastTransaction = func(string) (time.Time, bool) { return now.Add(time.Minute), true }
+	if err := manager.evaluate(now.Add(2 * time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	afterTransaction, _ := loadAnchor(manager.anchorPath())
+	if afterTransaction.Fingerprint == initial.Fingerprint {
+		t.Fatal("transaction-correlated change did not refresh anchor")
+	}
+}