_faultysampler

Overview ¶

Command faultysampler is an adversarial reference post-trace sampler plugin that verifies the engine's host-side bounds hold under hostile plugin behaviour. It implements both sdk.Sampler and sdk.HostAware, but its config selects one or more fault modes that deliberately abuse the telemetry façade:

• panicInUseHost: UseHost panics immediately; the engine must isolate the panic so telemetry is disabled for this plugin but the plugin continues to run (fail-open) and does not crash the data node.

• floodLogs: Decide emits thousands of Logger.Info calls per batch; the host's rate-limiter must clamp throughput to its declared budget (50 lines/s burst 100) so the data node's log stream is not flooded.

• explodeCardinality: Decide calls Meter.Counter with a unique label value per invocation, producing unbounded distinct series; the host's cardinality cap (100 series per plugin) must clamp the overflow so Prometheus scrape memory does not grow without bound.

Decision logic: always retain all traces (fail-open) regardless of fault mode, so liveness is not affected by the adversarial telemetry behaviour. Nil-safe: if UseHost was never called (host is nil — e.g. because the engine isolated a panic in UseHost) Decide proceeds without emitting any telemetry.

Config JSON (from SamplerPlugin.config Struct):

{
  "panicInUseHost":       false,
  "floodLogs":            false,
  "explodeCardinality":   false,
  "floodCount":           10000
}

All fields default to false / 10000. Multiple fault modes may be combined.

Build it as a Go plugin (the leading-underscore directory is intentionally excluded from `go build ./...` and linters, exactly like the reference _example directory, yet remains buildable by explicit path):

CGO_ENABLED=1 go build -buildmode=plugin -trimpath \
  -o faultysampler.so \
  ./test/plugins/_faultysampler