feat(go): advance validation sidecar toward production

go-agent/internal/events/exec_event.go

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package events implements the event-driven rule layer independently from
+// its eventual kernel source. Keeping event records and matching pure makes
+// Python/Go parity testable before cilium/ebpf enters the build.
+package events
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+// ExecEvent is one execve observed at execution time. Argv excludes filename,
+// matching the Python event model and the current BCC source contract.
+type ExecEvent struct {
+	PID        int      `json:"pid"`
+	PPID       int      `json:"ppid"`
+	UID        int      `json:"uid"`
+	ParentComm string   `json:"parent_comm"`
+	Filename   string   `json:"filename"`
+	Argv       []string `json:"argv"`
+}
+
+// ExecComm intentionally mirrors posixpath.basename rather than filepath.Base:
+// Python returns an empty basename for a path ending in '/', while filepath
+// cleans the trailing separator and would return the previous component.
+func (e ExecEvent) ExecComm() string {
+	if index := strings.LastIndex(e.Filename, "/"); index >= 0 {
+		return e.Filename[index+1:]
+	}
+	return e.Filename
+}
+
+func (e ExecEvent) ArgvString() string {
+	parts := make([]string, 0, len(e.Argv)+1)
+	parts = append(parts, e.Filename)
+	parts = append(parts, e.Argv...)
+	return strings.TrimSpace(strings.Join(parts, " "))
+}
+
+func (e *ExecEvent) UnmarshalJSON(raw []byte) error {
+	var values map[string]any
+	if err := json.Unmarshal(raw, &values); err != nil {
+		return err
+	}
+	e.PID = integerValue(values["pid"], 0)
+	e.PPID = integerValue(values["ppid"], 0)
+	e.UID = integerValue(values["uid"], 0)
+	e.ParentComm = stringValue(values["parent_comm"])
+	e.Filename = stringValue(values["filename"])
+	e.Argv = stringSlice(values["argv"])
+	return nil
+}