luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port process access detectors

Browse source
This commit is contained in:
Luna 2026-07-10 05:19:56 -07:00
parent f02509aab5
commit fc9b5f0448
22 changed files with 554 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/ROADMAP.md
View file

@ -260,9 +260,10 @@ Exit criteria:
- Suricata model assimilation design is complete, and Phase 0's additive
`enodia.event.v1` Python reference contract is implemented.
- Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
injectable process state, and the first poll-detector port (`deleted_exe`)
are checked against the Python oracle with a shared fixture. The Go sidecar
remains stdout-only and non-production until broader detector parity lands.
injectable process/file-descriptor state, and the first poll-detector cohort
(`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`) are
checked against the Python oracle with a shared fixture. The Go sidecar
remains stdout-only and non-production until broader parity lands.
## Backlog