luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): add bounded hot-path enrichment

Browse source
This commit is contained in:
Luna 2026-07-22 02:03:30 -07:00
parent 538d1d954a
commit fd2bbba0d7
No known key found for this signature in database
6 changed files with 282 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/PACKAGING.md
View file

@ -93,9 +93,11 @@ Same-second events are merged into one snapshot, required
`max_snapshots` / `max_snapshot_age_days` settings bound retention. The current
sidecar also writes a private atomic `incidents.json` with the required
`enodia.incident.v1` fields, process-lineage/time-window grouping, and additive
correlation evidence. The Go enrichment block is intentionally minimal; Python
remains authoritative for rich enrichment, assurance chaining, notifications,
and management consumers.
correlation evidence. Hot-path Go enrichment is bounded and no-I/O: process and
parent context, lineage, remote classification, and candidate paths come from
already-captured records. Python remains authoritative for ownership/hashes,
file and integrity metadata, assurance chaining, notifications, and management
consumers.
Each successful sweep atomically refreshes
`/var/lib/enodia-sentinel-go/heartbeat` as a Unix timestamp with mode `0600`;