luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): add bounded hot-path enrichment

Browse source
This commit is contained in:
Luna 2026-07-22 02:03:30 -07:00
parent 538d1d954a
commit fd2bbba0d7
No known key found for this signature in database
6 changed files with 282 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

8
go-agent/README.md
View file

@ -112,9 +112,11 @@ counts are populated only from parseable retained snapshots. Each snapshot is
linked to an incident in a private atomic `incidents.json` index. Grouping uses
the configured `incident_tracking`, `incident_window`, and
`incident_lineage_depth` settings; same-second alert batches update one incident
and one snapshot name idempotently. Enrichment is currently limited to a
Go-source marker plus best-effort process detail; the Python forensic
enrichment/assurance and notification pipelines remain future parity work.
and one snapshot name idempotently. Hot-path enrichment derives bounded
process/parent context, lineage, remote-IP classification, and candidate paths
from already-captured data without new I/O. Package ownership, hashes, file
metadata, integrity anchors, assurance chaining, and notifications remain
future parity work.
After every successfully emitted status record, the service atomically updates
`/var/lib/enodia-sentinel-go/heartbeat` with the current Unix timestamp (mode