Documentation
¶
Index ¶
- Constants
- Variables
- func CloseBinding(db *sql.DB, processID, endedAt string) error
- func CloseBindingByPID(db *sql.DB, pid int64, endedAt string) error
- func DefaultBindingConfidence(bindingSource string) float64
- func EventPayloadWithCorrelation(payload string, match Match, resolved bool) string
- func RecordBinding(db *sql.DB, binding Binding) (string, error)
- type Binding
- type BindingFilter
- type Match
- type RawIdentity
Constants ¶
const BindingSourceK8sCgroup = "k8s_cgroup"
BindingSourceK8sCgroup marks a scope established by passive cgroup→pod attribution (a node sensor observing an externally-scheduled pod we did not launch), as opposed to a scope we launched via record/control-plane.
Variables ¶
var MaxOpenBindingAge = 24 * time.Hour
MaxOpenBindingAge bounds how long a binding left open (ended_at = "") is allowed to match telemetry. Without it, a binding whose CloseBinding was dropped - every close call is best-effort (record/control) - would match every future event for its container/pid forever, silently over-binding later, unrelated executions to a stale context. An open binding only matches events within this window after it started; older events fall through to the next resolution tier or to unresolved.
PRODUCT SEMANTICS: this assumes an open binding represents a SHORT-LIVED ToolCallScope (a tool call / process lifetime), not a session-lifetime identity. A long-running agent or session that stays open past this window without a close/reopen will see its real events go unresolved rather than risk mis-binding - which is the safe failure here. Session-lifetime identity that legitimately exceeds 24h must keep its binding refreshed (re-record on activity) or model itself as a series of scoped bindings, not one perpetual open binding. Tune via this var if the deployment's scope lifetimes differ.
Functions ¶
func CloseBindingByPID ¶ added in v0.3.0
CloseBindingByPID closes open bindings for an OS pid, used when a system process_exit is observed (the kernel pid is known, our internal process_id is not). Setting ended_at bounds the binding's match window so it no longer over-binds later, unrelated events that reuse the pid -- the stale-open problem MaxOpenBindingAge only partially guards. Matches pid, not root_pid: a child exiting must not close the scope-root's binding.
func DefaultBindingConfidence ¶ added in v0.7.0
DefaultBindingConfidence caps how much a binding may vouch for a match by how it was established, when the caller did not set an explicit confidence. scanOne takes the MIN of this binding confidence and the resolution method's own confidence, so an app-asserted (ai_asserted) join can never read as certain as a kernel-verified one even if it happens to match by pid. This is the honesty tier: a scope the model merely CLAIMED is worth less than one the control plane launched or the kernel witnessed.
Types ¶
type Binding ¶
type Binding struct {
ID string
RunID string
SessionID string
AttemptID string
ToolCallID string
ProcessID string
ContainerID string
CgroupID string
RootPID int64
PID int64
StartedAt string
EndedAt string
BindingSource string
Confidence float64
}
func ListBindings ¶
func ListBindings(db *sql.DB, filter BindingFilter) ([]Binding, error)
Source Files