feat(go): add Phase 1 parity sidecar

go-agent/README.md

@@ -0,0 +1,35 @@
+# Enodia Sentinel Go Agent (Phase 1 Prototype)
+
+This directory is the parallel Go implementation described in
+`docs/SURICATA_ASSIMILATION.md`. Python remains the production agent and the
+behavioral oracle until every subsystem reaches fixture and red-team parity.
+
+Current scope:
+
+- standard-library-only flat TOML loading for the settings used so far;
+- an injectable `/proc` process snapshot boundary;
+- a cancellable sweep loop that emits JSONL `enodia.event.v1` records;
+- exact `enodia.alert.v1` parity for the `deleted_exe` detector (SID `100012`);
+- `enodia.status.v1` heartbeat records with no persistence or retained-alert
+  claims;
+- a shared fixture checked against the Python detector by
+  `scripts/check-go-parity.py`.
+
+It does not install a service, write Python state, capture eBPF events, retain
+snapshots, or replace `enodia-sentinel`. Run a single terminal-visible sweep:
+
+```bash
+cd go-agent
+GOCACHE=/tmp/enodia-go-cache go run ./cmd/enodia-sentinel-go --once
+```
+
+Development verification from the repository root:
+
+```bash
+make test-go
+make parity-go
+```
+
+`--fixture`, `--host`, `--timestamp`, and `--proc-root` exist for deterministic
+parity/testing. Production work should continue to use the default live
+`/proc`, hostname, and local timestamp.