luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): enrich snapshots asynchronously

Browse source
This commit is contained in:
Luna 2026-07-22 03:10:26 -07:00
parent 1ab4add205
commit eff31b3a82
No known key found for this signature in database
7 changed files with 270 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/GO_PORT_HANDOFF.md
View file

@ -1,8 +1,8 @@
# Go Port Handoff
Saved: 2026-07-22T02:10:00-07:00
Saved: 2026-07-22T02:22:00-07:00
Branch: `main`
Base commit: `fd2bbba` (`feat(go): add bounded hot-path enrichment`)
Base commit: `1ab4add` (`feat(go): chain retained snapshot artifacts`)
Status: implemented and green, but uncommitted
## Worktree warning
@ -10,9 +10,9 @@ Status: implemented and green, but uncommitted
The checkout is intentionally dirty and contains work from multiple related
continuations. Do not reset, clean, or broadly restage it.
- The validation-sidecar, incident-persistence, and bounded-enrichment tranches
are signed commits `f85c2e8`, `538d1d9`, and `fd2bbba`. The local-assurance
slice is uncommitted.
- The validation-sidecar, incident-persistence, bounded-enrichment, and local-
assurance tranches are signed commits `f85c2e8`, `538d1d9`, `fd2bbba`, and
`1ab4add`. The asynchronous-enrichment slice is uncommitted.
- At this checkpoint, `git status --short` has 20 entries with untracked
directories collapsed.
- The Python GUI files and tests are separate pre-existing work. Preserve them
@ -99,8 +99,11 @@ static binary.
`enodia.hash_chain.v1` records. Artifact SHA-256 is streamed, previous-hash
lookup reads a bounded chain tail, and append completion is synced before the
alert event is emitted.
- Package ownership, executable enrichment hashes, file metadata, richer
integrity anchors, and notification fan-out are not yet ported.
- A single 16-job asynchronous worker now streams SHA-256 only for regular
executables at most 8 MiB and adds lstat file metadata. Slow I/O occurs
outside the snapshot lock; a full queue simply leaves optional fields unknown.
- Package ownership, richer integrity anchors, and notification fan-out are not
yet ported.
- No live system service was installed or enabled during development.
## Last green verification
@ -145,9 +148,8 @@ the suite still exits successfully.
## Resume here
1. Move slow enrichment collectors (ownership, bounded executable hashing, file
metadata, integrity anchors) behind a bounded asynchronous worker without
destructive response behavior.
1. Add bounded package-ownership and integrity-anchor collectors to the existing
asynchronous worker without destructive response behavior.
2. Connect the isolated Go snapshot/event state to explicit read-only
management consumers while keeping Python authoritative.
3. Continue broader Phase 3 rule metadata/state parity before considering any

7
docs/PACKAGING.md
View file

@ -95,8 +95,11 @@ sidecar also writes a private atomic `incidents.json` with the required
`enodia.incident.v1` fields, process-lineage/time-window grouping, and additive
correlation evidence. Hot-path Go enrichment is bounded and no-I/O: process and
parent context, lineage, remote classification, and candidate paths come from
already-captured records. Python remains authoritative for ownership/hashes,
file and richer integrity metadata, notifications, and management consumers.
already-captured records. A bounded asynchronous worker subsequently hashes
regular executables no larger than 8 MiB and records file metadata; a full queue
skips those optional fields without delaying an alert. Python remains
authoritative for package ownership, richer integrity metadata, notifications,
and management consumers.
Each snapshot text/JSON revision is SHA-256 hashed into a synchronized private
`hash-chain.jsonl` using the stable `enodia.hash_chain.v1` record schema.