feat(go): add Phase 1 parity sidecar

go-agent/internal/schema/event.go

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package schema implements the Go side of Sentinel's stable JSON contracts.
+package schema
+
+import (
+	"fmt"
+	"os"
+	"time"
+)
+
+const (
+	EventV1  = "enodia.event.v1"
+	AlertV1  = "enodia.alert.v1"
+	StatusV1 = "enodia.status.v1"
+)
+
+var eventTypes = map[string]bool{
+	"alert": true, "incident": true, "status": true,
+}
+
+// Status matches the required enodia.status.v1 fields. The prototype sidecar
+// has no retained snapshots yet, so those counts remain empty/zero.
+type Status struct {
+	Schema         string         `json:"schema"`
+	Version        string         `json:"version"`
+	Running        bool           `json:"running"`
+	TotalAlerts    int            `json:"total_alerts"`
+	Counts         map[string]int `json:"counts"`
+	LastAlert      *string        `json:"last_alert"`
+	EBPF           string         `json:"ebpf"`
+	EBPFExec       string         `json:"ebpf_exec"`
+	EBPFSyscall    string         `json:"ebpf_syscall"`
+	Host           string         `json:"host"`
+	HeartbeatAge   *float64       `json:"heartbeat_age"`
+	HeartbeatStale bool           `json:"heartbeat_stale"`
+}
+
+// Build returns the EVE-style enodia.event.v1 envelope used by Python.
+func Build(eventType string, payload any, host, timestamp string) (map[string]any, error) {
+	if !eventTypes[eventType] {
+		return nil, fmt.Errorf("unknown event_type: %q", eventType)
+	}
+	if host == "" {
+		var err error
+		host, err = os.Hostname()
+		if err != nil {
+			return nil, err
+		}
+	}
+	if timestamp == "" {
+		timestamp = time.Now().Local().Format(time.RFC3339Nano)
+	}
+	return map[string]any{
+		"schema":     EventV1,
+		"event_type": eventType,
+		"timestamp":  timestamp,
+		"host":       host,
+		eventType:    payload,
+	}, nil
+}

go-agent/internal/schema/event_test.go

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package schema
+
+import (
+	"testing"
+	"time"
+)
+
+func TestBuildMatchesEventV1Shape(t *testing.T) {
+	payload := map[string]any{"sid": 100010}
+	event, err := Build("alert", payload, "host-a", "2026-07-10T00:00:00-07:00")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if event["schema"] != EventV1 || event["event_type"] != "alert" || event["host"] != "host-a" {
+		t.Fatalf("unexpected envelope: %#v", event)
+	}
+	if event["alert"].(map[string]any)["sid"] != 100010 {
+		t.Fatalf("payload not preserved: %#v", event["alert"])
+	}
+}
+
+func TestBuildDefaultsParseAndUnknownTypeFails(t *testing.T) {
+	event, err := Build("status", map[string]any{"running": true}, "", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := time.Parse(time.RFC3339Nano, event["timestamp"].(string)); err != nil {
+		t.Fatalf("timestamp is not RFC3339: %v", err)
+	}
+	if event["host"] == "" {
+		t.Fatal("default host must be populated")
+	}
+	if _, err := Build("nope", nil, "", ""); err == nil {
+		t.Fatal("unknown event type must fail")
+	}
+}