luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): add bounded hot-path enrichment

Browse source
This commit is contained in:
Luna 2026-07-22 02:03:30 -07:00
parent 538d1d954a
commit fd2bbba0d7
No known key found for this signature in database
6 changed files with 282 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/GO_PORT_HANDOFF.md
View file

@ -1,8 +1,8 @@
# Go Port Handoff
Saved: 2026-07-22T01:58:38-07:00
Saved: 2026-07-22T02:03:00-07:00
Branch: `main`
Base commit: `f85c2e8` (`feat(go): advance validation sidecar toward production`)
Base commit: `6d5a897` (`feat(go): persist Python-compatible incidents`)
Status: implemented and green, but uncommitted
## Worktree warning
@ -10,8 +10,8 @@ Status: implemented and green, but uncommitted
The checkout is intentionally dirty and contains work from multiple related
continuations. Do not reset, clean, or broadly restage it.
- The completed validation-sidecar tranche was committed as `f85c2e8` before
this continuation. The current Go incident tranche is not yet committed.
- The validation-sidecar and incident-persistence tranches are committed as
`f85c2e8` and `6d5a897`. The bounded-enrichment slice is uncommitted.
- At this checkpoint, `git status --short` has 20 entries with untracked
directories collapsed.
- The Python GUI files and tests are separate pre-existing work. Preserve them
@ -90,9 +90,12 @@ static binary.
additively and correlation SID `100080` is persisted. Python's unchanged
`list_incidents` and `get_incident` consumers successfully loaded a live
Go-produced index, snapshot, and timeline.
- Enrichment currently contains only a Go-source marker plus process detail;
rich enrichment, assurance chaining, and notification fan-out are not yet
ported.
- A bounded no-I/O enrichment stage now derives Python-shaped process/parent
context, lineage, remote-IP classification, and candidate paths entirely from
already-captured records. Alert/process/indicator caps bound attacker-
controlled work on the emission path.
- Package ownership, executable hashes, file metadata, integrity anchors,
assurance chaining, and notification fan-out are not yet ported.
- No live system service was installed or enabled during development.
## Last green verification
@ -137,9 +140,9 @@ the suite still exits successfully.
## Resume here
1. Port bounded post-alert enrichment and local assurance chaining without
adding destructive response behavior or blocking the event loop on slow
collectors.
1. Move slow enrichment collectors (ownership, bounded hashing, file metadata,
integrity anchors) behind a bounded asynchronous worker, then add local
assurance chaining without destructive response behavior.
2. Connect the isolated Go snapshot/event state to explicit read-only
management consumers while keeping Python authoritative.
3. Continue broader Phase 3 rule metadata/state parity before considering any

8
docs/PACKAGING.md
View file

@ -93,9 +93,11 @@ Same-second events are merged into one snapshot, required
`max_snapshots` / `max_snapshot_age_days` settings bound retention. The current
sidecar also writes a private atomic `incidents.json` with the required
`enodia.incident.v1` fields, process-lineage/time-window grouping, and additive
correlation evidence. The Go enrichment block is intentionally minimal; Python
remains authoritative for rich enrichment, assurance chaining, notifications,
and management consumers.
correlation evidence. Hot-path Go enrichment is bounded and no-I/O: process and
parent context, lineage, remote classification, and candidate paths come from
already-captured records. Python remains authoritative for ownership/hashes,
file and integrity metadata, assurance chaining, notifications, and management
consumers.
Each successful sweep atomically refreshes
`/var/lib/enodia-sentinel-go/heartbeat` as a Unix timestamp with mode `0600`;