# Enodia Sentinel Go Agent (Phase 1 Prototype)

This directory is the parallel Go implementation described in
`docs/SURICATA_ASSIMILATION.md`. Python remains the production agent and the
behavioral oracle until every subsystem reaches fixture and red-team parity.

Current scope:

- standard-library-only flat TOML loading for the settings used so far;
- an injectable `/proc` process snapshot boundary;
- a cancellable sweep loop that emits JSONL `enodia.event.v1` records;
- exact `enodia.alert.v1` parity for the `deleted_exe` detector (SID `100012`);
- `enodia.status.v1` heartbeat records with no persistence or retained-alert
  claims;
- a shared fixture checked against the Python detector by
  `scripts/check-go-parity.py`.

It does not install a service, write Python state, capture eBPF events, retain
snapshots, or replace `enodia-sentinel`. Run a single terminal-visible sweep:

```bash
cd go-agent
GOCACHE=/tmp/enodia-go-cache go run ./cmd/enodia-sentinel-go --once
```

Development verification from the repository root:

```bash
make test-go
make parity-go
```

`--fixture`, `--host`, `--timestamp`, and `--proc-root` exist for deterministic
parity/testing. Production work should continue to use the default live
`/proc`, hostname, and local timestamp.