feat(go): add Phase 1 parity sidecar

This commit is contained in:
Luna 2026-07-10 05:02:50 -07:00
parent 65f5be6420
commit f02509aab5
22 changed files with 947 additions and 6 deletions

View file

@ -226,7 +226,10 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
as event types). This is the Python↔Go contract. *No language change yet.*
- **Phase 1 — Go agent skeleton.** Config, daemon sweep loop, `SystemState`
equivalent, poll detectors ported, JSON output matching schemas. Runs
alongside Python; harness compares both.
alongside Python; harness compares both. *In progress:* the isolated
`go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
process view, the JSONL sweep loop, and fixture parity for `deleted_exe`;
Python remains the production agent.
- **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
bcc/Python runtime dependency; single static binary.
- **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,