feat(go): add Phase 1 parity sidecar

docs/ROADMAP.md

@@ -255,6 +255,15 @@ Exit criteria:
 - A local root attacker has to tamper with both the host and an external or
   hardware-backed trust anchor to hide compromise.
 
+## Active Migration Track
+
+- Suricata model assimilation design is complete, and Phase 0's additive
+  `enodia.event.v1` Python reference contract is implemented.
+- Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
+  injectable process state, and the first poll-detector port (`deleted_exe`)
+  are checked against the Python oracle with a shared fixture. The Go sidecar
+  remains stdout-only and non-production until broader detector parity lands.
+
 ## Backlog
 
 Useful ideas that need design before implementation:
@@ -263,9 +272,6 @@ Useful ideas that need design before implementation:
 - YARA-compatible scanning for selected paths.
 - Sigma-like host event rules.
 - SBOM and package provenance reporting.
-- Suricata model assimilation: stateful sessions, EVE-style event envelope,
-  rule metadata/thresholding, datasets, and triggered forensic capture
-  ([SURICATA_ASSIMILATION.md](SURICATA_ASSIMILATION.md)).
 - Offline evidence bundle for outside analysis.
 - Dashboard import of exported incident bundles.
 - Support for non-pacman package managers in signed-package verification.

docs/SCHEMAS.md

@@ -29,8 +29,11 @@ Required fields:
 | `host` | string | Hostname at emission time. |
 | `<event_type>` | object | Payload, under a key equal to `event_type` (e.g. `alert` holds an `enodia.alert.v1` object). |
 
-The reference encoder lives in `enodia_sentinel/event.py`
+The Python reference encoder lives in `enodia_sentinel/event.py`
 (`build_event`, `from_alert`); `tests/test_event_envelope.py` pins the contract.
+The experimental Go encoder lives in `go-agent/internal/schema`; the shared
+fixture harness `scripts/check-go-parity.py` compares its alert envelopes with
+the Python oracle.
 
 ## `enodia.alert.v1`
 

docs/SURICATA_ASSIMILATION.md

@@ -226,7 +226,10 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   as event types). This is the Python↔Go contract. *No language change yet.*
 - **Phase 1 — Go agent skeleton.** Config, daemon sweep loop, `SystemState`
   equivalent, poll detectors ported, JSON output matching schemas. Runs
-  alongside Python; harness compares both.
+  alongside Python; harness compares both. *In progress:* the isolated
+  `go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
+  process view, the JSONL sweep loop, and fixture parity for `deleted_exe`;
+  Python remains the production agent.
 - **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
   bcc/Python runtime dependency; single static binary.
 - **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,