feat(go): advance validation sidecar toward production

go-agent/internal/events/syscall_event.go

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package events
+
+import "encoding/json"
+
+// SyscallEvent is the transport-neutral security telemetry consumed by the
+// syscall rules. Unsupplied arguments decode as zero, matching Python's
+// dataclass defaults and the partial fixtures accepted by rule operations.
+type SyscallEvent struct {
+	PID     int       `json:"pid"`
+	PPID    int       `json:"ppid"`
+	UID     int       `json:"uid"`
+	Comm    string    `json:"comm"`
+	Syscall string    `json:"syscall"`
+	Args    [6]uint64 `json:"args"`
+	Text    string    `json:"text"`
+}
+
+func (e *SyscallEvent) UnmarshalJSON(raw []byte) error {
+	var values map[string]any
+	if err := json.Unmarshal(raw, &values); err != nil {
+		return err
+	}
+	e.PID = integerValue(values["pid"], 0)
+	e.PPID = integerValue(values["ppid"], 0)
+	e.UID = integerValue(values["uid"], 0)
+	e.Comm = stringValue(values["comm"])
+	e.Syscall = stringValue(values["syscall"])
+	e.Text = stringValue(values["text"])
+	if args, ok := values["args"].([]any); ok {
+		for index := 0; index < len(args) && index < len(e.Args); index++ {
+			e.Args[index] = uint64(integerValue(args[index], 0))
+		}
+	}
+	for index, key := range []string{"arg0", "arg1", "arg2", "arg3", "arg4", "arg5"} {
+		if value, ok := values[key]; ok {
+			e.Args[index] = uint64(integerValue(value, int(e.Args[index])))
+		}
+	}
+	return nil
+}