correlation

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 30, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var MaxOpenBindingAge = 24 * time.Hour

MaxOpenBindingAge bounds how long a binding left open (ended_at = "") is allowed to match telemetry. Without it, a binding whose CloseBinding was dropped - every close call is best-effort (record/control/stressdemo) - would match every future event for its container/pid forever, silently over-binding later, unrelated executions to a stale context. An open binding only matches events within this window after it started; older events fall through to the next resolution tier or to unresolved.

PRODUCT SEMANTICS: this assumes an open binding represents a SHORT-LIVED ToolCallScope (a tool call / process lifetime), not a session-lifetime identity. A long-running agent or session that stays open past this window without a close/reopen will see its real events go unresolved rather than risk mis-binding - which is the safe failure here. Session-lifetime identity that legitimately exceeds 24h must keep its binding refreshed (re-record on activity) or model itself as a series of scoped bindings, not one perpetual open binding. Tune via this var if the deployment's scope lifetimes differ.

Functions

func CloseBinding

func CloseBinding(db *sql.DB, processID, endedAt string) error

func CloseBindingByPID added in v0.3.0

func CloseBindingByPID(db *sql.DB, pid int64, endedAt string) error

CloseBindingByPID closes open bindings for an OS pid, used when a system process_exit is observed (the kernel pid is known, our internal process_id is not). Setting ended_at bounds the binding's match window so it no longer over-binds later, unrelated events that reuse the pid -- the stale-open problem MaxOpenBindingAge only partially guards. Matches pid, not root_pid: a child exiting must not close the scope-root's binding.

func EventPayloadWithCorrelation

func EventPayloadWithCorrelation(payload string, match Match, resolved bool) string

func RecordBinding

func RecordBinding(db *sql.DB, binding Binding) (string, error)

Types

type Binding

type Binding struct {
	ID            string
	RunID         string
	SessionID     string
	AttemptID     string
	ToolCallID    string
	ProcessID     string
	ContainerID   string
	CgroupID      string
	RootPID       int64
	PID           int64
	StartedAt     string
	EndedAt       string
	BindingSource string
	Confidence    float64
}

func GetBinding

func GetBinding(db *sql.DB, id string) (Binding, bool, error)

func ListBindings

func ListBindings(db *sql.DB, filter BindingFilter) ([]Binding, error)

type BindingFilter

type BindingFilter struct {
	RunID      string
	SessionID  string
	AttemptID  string
	ToolCallID string
	ProcessID  string
}

type Match

type Match struct {
	Binding
	Method     string
	Confidence float64
}

func Resolve

func Resolve(db *sql.DB, raw RawIdentity) (Match, bool, error)

type RawIdentity

type RawIdentity struct {
	RunID       string
	ProcessID   string
	ContainerID string
	CgroupID    string
	PID         int64
	TGID        int64
	PPID        int64
	Timestamp   string
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL