d835386381
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.
Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.
Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
22 lines
868 B
Python
22 lines
868 B
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Stable JSON schema identifiers for operator-facing contracts.
|
|
|
|
These are lightweight schema IDs, not a full JSON Schema implementation. Tests
|
|
pin the minimum v1 fields and types so downstream automation can rely on them
|
|
while newer releases remain free to add fields.
|
|
"""
|
|
|
|
ALERT_V1 = "enodia.alert.v1"
|
|
ALERT_SNAPSHOT_V1 = "enodia.alert.snapshot.v1"
|
|
INCIDENT_V1 = "enodia.incident.v1"
|
|
INCIDENT_VIEW_V1 = "enodia.incident.view.v1"
|
|
INCIDENT_BUNDLE_V1 = "enodia.incident.bundle.v1"
|
|
STATUS_V1 = "enodia.status.v1"
|
|
INTEGRITY_V1 = "enodia.integrity.v1"
|
|
HASH_CHAIN_V1 = "enodia.hash_chain.v1"
|
|
FIRST_SEEN_V1 = "enodia.first_seen.v1"
|
|
RESPONSE_PLAN_V1 = "enodia.response.plan.v1"
|
|
RESPONSE_AUDIT_V1 = "enodia.response.audit.v1"
|
|
RECONCILE_V1 = "enodia.reconcile.v1"
|
|
EVENT_V1 = "enodia.event.v1"
|
|
GO_SIDECAR_V1 = "enodia.go.sidecar.v1"
|