provenance

package
v0.7.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 5, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BlameFile 

func BlameFile(db *sql.DB, runID, filePath string, out io.Writer) error

func BlameFileJSON 

func BlameFileJSON(db *sql.DB, runID, filePath string, out io.Writer) error

func DiffFile 

func DiffFile(db *sql.DB, runID, filePath string, out io.Writer) error

func DiffFileJSON 

func DiffFileJSON(db *sql.DB, runID, filePath string, out io.Writer) error

func Explain 

func Explain(db *sql.DB, opts ExplainOptions, out io.Writer) error

func GraphLens added in v0.4.0 

func GraphLens(db *sql.DB, opts GraphLensOptions, out io.Writer) error

func GraphLensJSON added in v0.4.0 

func GraphLensJSON(db *sql.DB, opts GraphLensOptions, out io.Writer) error

func HarvestTranscriptSet added in v0.7.2 

func HarvestTranscriptSet(store ObjectStore, db *sql.DB, runID, mainPath string, subs []AgentTranscript) (int, error)

HarvestTranscriptSet harvests the main session transcript and every sub-agent transcript into the shared llm_call graph. Sub-agent turns are namespaced by agent id so they neither collide with the main turns nor with each other, and so a missing/unreadable sub-agent file is skipped rather than aborting the run. The single up-front cleanup makes the whole set idempotent per run.

func HarvestTranscriptsFromHookLog added in v0.7.2 

func HarvestTranscriptsFromHookLog(store ObjectStore, db *sql.DB, runID, hookLogPath string) (int, error)

HarvestTranscriptsFromHookLog harvests every transcript a run's hook log points at -- each distinct main session transcript_path AND each sub-agent agent_transcript_path -- into the llm_call graph. Unlike the launch path (one main + its sub-agents), a hook log can span several main sessions (e.g. the double-attempt demo's recon + team runs in one run graph); each is namespaced distinctly so none collide or get dropped. This is the reusable entry point for pipelines that seal a run outside `launch`.

func Log 

func Log(db *sql.DB, runID string, out io.Writer) error

func MaterializeLLMCalls added in v0.6.0 

func MaterializeLLMCalls(store ObjectStore, db *sql.DB, runID string) (int, error)

MaterializeLLMCalls turns the captured LLM traffic into verifiable evidence: each reassembled tls_write/tls_read body (when full capture is on) is stored as a content-addressed `llm_message` object, and every paired request/response (from the ingest-time `llm_call` edge) becomes a first-class `llm_call` node that references the model's actual prompt and completion. Idempotent. Returns the number of llm_call nodes built.

func Objects 

func Objects(db *sql.DB, runID string, out io.Writer) error

func ObjectsJSON 

func ObjectsJSON(db *sql.DB, runID string, out io.Writer) error

func ObjectsPage 

func ObjectsPage(db *sql.DB, opts ObjectListOptions, out io.Writer) error

func ObjectsPageJSON 

func ObjectsPageJSON(db *sql.DB, opts ObjectListOptions, out io.Writer) error

func PrintBlameFile 

func PrintBlameFile(out io.Writer, manifest FileBlameManifest)

func PrintDiffFile 

func PrintDiffFile(out io.Writer, manifest FileDiffManifest)

func PrintExplainManifest 

func PrintExplainManifest(out io.Writer, manifest ExplainManifest) error

func PrintExplainManifestJSON 

func PrintExplainManifestJSON(out io.Writer, manifest ExplainManifest) error

func PrintGraphLensManifest added in v0.4.0 

func PrintGraphLensManifest(out io.Writer, manifest GraphLensManifest) error

func PrintGraphLensManifestJSON added in v0.4.0 

func PrintGraphLensManifestJSON(out io.Writer, manifest GraphLensManifest) error

func PrintMaterializeResult 

func PrintMaterializeResult(out io.Writer, result MaterializeResult)

func PrintReplayManifest 

func PrintReplayManifest(out io.Writer, manifest ReplayManifest)

func PrintReplayManifestJSON 

func PrintReplayManifestJSON(out io.Writer, manifest ReplayManifest) error

func PrintTimelineCausality 

func PrintTimelineCausality(manifest TimelineManifest, out io.Writer) error

func PrintTimelineManifest 

func PrintTimelineManifest(manifest TimelineManifest, out io.Writer) error

func PrintTrajectoryManifest 

func PrintTrajectoryManifest(out io.Writer, manifest TrajectoryManifest)

func PrintVerifyResult 

func PrintVerifyResult(out io.Writer, result VerifyResult)

func PrintVerifyResultJSON 

func PrintVerifyResultJSON(out io.Writer, result VerifyResult) error

func Refs 

func Refs(db *sql.DB, runID string, out io.Writer) error

func ReplayAttempt 

func ReplayAttempt(db *sql.DB, attemptID string, out io.Writer) error

func ReplayAttemptJSON 

func ReplayAttemptJSON(db *sql.DB, attemptID string, out io.Writer) error

func ReplayRun 

func ReplayRun(db *sql.DB, runID string, out io.Writer) error

func ReplayRunJSON 

func ReplayRunJSON(db *sql.DB, runID string, out io.Writer) error

func TraceArtifact 

func TraceArtifact(db *sql.DB, artifactRef string, out io.Writer) error

func TraceAttempt 

func TraceAttempt(db *sql.DB, attemptID string, out io.Writer) error

func TraceProcess 

func TraceProcess(db *sql.DB, processID string, out io.Writer) error

func TraceRun 

func TraceRun(db *sql.DB, runID string, out io.Writer) error

func TraceToolCall 

func TraceToolCall(db *sql.DB, toolCallID string, out io.Writer) error

func TrajectoriesRun 

func TrajectoriesRun(db *sql.DB, runID string, out io.Writer) error

func TrajectoriesRunJSON 

func TrajectoriesRunJSON(db *sql.DB, runID string, out io.Writer) error

func VerifyRun 

func VerifyRun(db *sql.DB, runID string, out io.Writer) error

func VerifyRunJSON 

func VerifyRunJSON(db *sql.DB, runID string, out io.Writer) error

Types

type AgentTranscript added in v0.7.2 

type AgentTranscript struct {
	AgentID string
	Path    string
}

AgentTranscript is a sub-agent's own session transcript, located via the hook log's agent_transcript_path. The command a sub-agent decided to run lives here, not in the main session transcript -- so without harvesting these, a command decided by a delegate never becomes an llm_call and can never carry an llm_caused edge (the multi-agent half of the demo llm_caused=0 gap).

type EndpointResult added in v0.7.2 

type EndpointResult struct {
	LLMCalls      int `json:"llm_calls"`
	Egress        int `json:"egress"`
	BlockedEgress int `json:"blocked_egress"`
}

EndpointResult summarizes an endpoint-dump ingestion.

func IngestEndpointDump added in v0.7.2 

func IngestEndpointDump(store ObjectStore, db *sql.DB, runID, dumpDir string) (EndpointResult, error)

IngestEndpointDump folds a capture proxy's dump into the run graph for agents whose TLS the libssl uprobe can't read (e.g. rustls CLIs like Grok): the model traffic and the data egress are captured at the controlled endpoint instead.

  • /chat/completions + /responses -> an llm_call node (the model turn); the response is inspected for tool_calls so the graph can assert the model "declared" nothing but text.
  • /v1/upload/storage + /v1/traces -> a network_connect egress EVENT (so the intent diff sees an effect with no declared intent) plus a content-addressed descriptor of the payload (a git bundle of the repo) as evidence. A blocked upload is marked blocked/deny so the enforcement shows in the graph.

type ExplainEvent 

type ExplainEvent struct {
	ID                    string                      `json:"id"`
	RunID                 string                      `json:"run_id"`
	SessionID             string                      `json:"session_id"`
	ToolCallID            string                      `json:"tool_call_id"`
	ProcessID             string                      `json:"process_id"`
	SnapshotID            string                      `json:"snapshot_id"`
	Lane                  string                      `json:"lane,omitempty"`
	CorrelationStatus     string                      `json:"correlation_status,omitempty"`
	RawEventID            string                      `json:"raw_event_id"`
	CorrelationMethod     string                      `json:"correlation_method"`
	CorrelationConfidence float64                     `json:"correlation_confidence"`
	ContainerID           string                      `json:"container_id"`
	CgroupID              string                      `json:"cgroup_id"`
	PID                   int64                       `json:"pid"`
	TGID                  int64                       `json:"tgid"`
	PPID                  int64                       `json:"ppid"`
	Source                string                      `json:"source"`
	EventType             string                      `json:"event_type"`
	Payload               string                      `json:"payload"`
	CreatedAt             string                      `json:"created_at"`
	Telemetry             *telemetry.EventExplanation `json:"telemetry,omitempty"`
	Drilldowns            []string                    `json:"drilldowns,omitempty"`
}

type ExplainEvidence 

type ExplainEvidence struct {
	ID          string `json:"id"`
	RunID       string `json:"run_id"`
	RolloutID   string `json:"rollout_id"`
	AttemptID   string `json:"attempt_id"`
	SessionID   string `json:"session_id"`
	ToolCallID  string `json:"tool_call_id"`
	ProcessID   string `json:"process_id,omitempty"`
	SnapshotID  string `json:"snapshot_id"`
	EventType   string `json:"event_type"`
	Priority    string `json:"priority"`
	Status      string `json:"status"`
	Payload     string `json:"payload"`
	CreatedAt   string `json:"created_at"`
	ProcessedAt string `json:"processed_at"`
}

type ExplainGraphEdge 

type ExplainGraphEdge struct {
	RunID         string `json:"run_id"`
	RolloutID     string `json:"rollout_id"`
	FromID        string `json:"from_id"`
	ToID          string `json:"to_id"`
	EdgeType      string `json:"edge_type"`
	SourceEventID string `json:"source_event_id"`
	CreatedAt     string `json:"created_at"`
}

type ExplainManifest 

type ExplainManifest struct {
	SchemaVersion    string                      `json:"schema_version"`
	Target           ExplainTarget               `json:"target"`
	Query            ExplainQuery                `json:"query"`
	Summary          []string                    `json:"summary"`
	Upstream         []ExplainGraphEdge          `json:"upstream,omitempty"`
	Downstream       []ExplainGraphEdge          `json:"downstream,omitempty"`
	CausalityPath    []ExplainGraphEdge          `json:"causality_path,omitempty"`
	Evidence         []ExplainEvidence           `json:"evidence,omitempty"`
	Objects          []ExplainObjectRef          `json:"objects,omitempty"`
	Risks            []ExplainRisk               `json:"risks,omitempty"`
	Responses        []ExplainResponseAction     `json:"responses,omitempty"`
	ReplayRefs       []ExplainReplayRef          `json:"replay_refs,omitempty"`
	ProcessObs       []ExplainProcessObservation `json:"process_observations,omitempty"`
	TelemetryBatches []ExplainTelemetryBatch     `json:"telemetry_batches,omitempty"`
	RuntimeEdges     []ExplainGraphEdge          `json:"runtime_edges,omitempty"`
	RuntimeEvents    []ExplainEvent              `json:"runtime_events,omitempty"`
	FileDiff         *FileDiffManifest           `json:"file_diff,omitempty"`
	FileBlame        *FileBlameManifest          `json:"file_blame,omitempty"`
}

func BuildExplain 

func BuildExplain(db *sql.DB, opts ExplainOptions) (ExplainManifest, error)

type ExplainObjectRef 

type ExplainObjectRef struct {
	Hash         string `json:"hash"`
	Type         string `json:"type"`
	SourceID     string `json:"source_id"`
	RunID        string `json:"run_id"`
	RolloutID    string `json:"rollout_id"`
	ParentHashes string `json:"parent_hashes"`
	Path         string `json:"path"`
	SizeBytes    int64  `json:"size_bytes"`
	CreatedAt    string `json:"created_at"`
}

type ExplainOptions 

type ExplainOptions struct {
	RunID    string
	Artifact string
	Attempt  string
	ToolCall string
	Process  string
	Event    string
	Risk     string
	File     string
	Depth    int
	Limit    int
	Cursor   string
	WithJSON bool
}

type ExplainProcessObservation 

type ExplainProcessObservation struct {
	PID               int64    `json:"pid"`
	PPID              int64    `json:"ppid"`
	Command           string   `json:"command"`
	FirstSeen         string   `json:"first_seen"`
	LastSeen          string   `json:"last_seen"`
	OutlivedRoot      bool     `json:"outlived_root"`
	Boundary          string   `json:"boundary"`
	OrphanPolicy      string   `json:"orphan_policy"`
	SourceEventID     string   `json:"source_event_id"`
	ProcessID         string   `json:"process_id"`
	ToolCallID        string   `json:"tool_call_id"`
	EvidenceIDs       []string `json:"evidence_ids,omitempty"`
	PolicyDecisionIDs []string `json:"policy_decision_ids,omitempty"`
}

type ExplainQuery 

type ExplainQuery struct {
	Depth       int    `json:"depth"`
	Limit       int    `json:"limit"`
	Cursor      string `json:"cursor,omitempty"`
	NextCursor  string `json:"next_cursor,omitempty"`
	ResultSetID string `json:"result_set_id,omitempty"`
	PageHash    string `json:"page_hash,omitempty"`
	Truncated   bool   `json:"truncated"`
	EdgeCount   int    `json:"edge_count"`
	NodeCount   int    `json:"node_count"`
	FrontierHit bool   `json:"frontier_hit"`
}

type ExplainReplayRef 

type ExplainReplayRef struct {
	Kind string `json:"kind"`
	ID   string `json:"id"`
	Ref  string `json:"ref"`
}

type ExplainResponseAction 

type ExplainResponseAction struct {
	ID               string `json:"id"`
	RunID            string `json:"run_id"`
	SessionID        string `json:"session_id"`
	ProcessID        string `json:"process_id"`
	SnapshotID       string `json:"snapshot_id"`
	RiskSignalID     string `json:"risk_signal_id"`
	PolicyDecisionID string `json:"policy_decision_id"`
	ActionType       string `json:"action_type"`
	TargetType       string `json:"target_type"`
	TargetID         string `json:"target_id"`
	Status           string `json:"status"`
	ResultRef        string `json:"result_ref"`
	Payload          string `json:"payload"`
	CreatedAt        string `json:"created_at"`
}

type ExplainRisk 

type ExplainRisk struct {
	ID        string `json:"id"`
	RunID     string `json:"run_id"`
	EventID   string `json:"event_id"`
	SessionID string `json:"session_id"`
	RuleID    string `json:"rule_id"`
	Decision  string `json:"decision"`
	Reason    string `json:"reason"`
	CreatedAt string `json:"created_at"`
}

type ExplainTarget 

type ExplainTarget struct {
	Type string `json:"type"`
	ID   string `json:"id,omitempty"`
	Run  string `json:"run_id,omitempty"`
	File string `json:"file,omitempty"`
}

type ExplainTelemetryBatch 

type ExplainTelemetryBatch struct {
	ID             string   `json:"id"`
	RunID          string   `json:"run_id"`
	Format         string   `json:"format"`
	Path           string   `json:"path"`
	FileSHA256     string   `json:"file_sha256"`
	Read           int      `json:"read"`
	Ingested       int      `json:"ingested"`
	Skipped        int      `json:"skipped"`
	Failed         int      `json:"failed"`
	EventIDs       []string `json:"event_ids"`
	EventIDsSHA256 string   `json:"event_ids_sha256"`
	CreatedAt      string   `json:"created_at"`
}

type ExternalObjectInput 

type ExternalObjectInput struct {
	Type      string
	SourceID  string
	RunID     string
	RolloutID string
	Parents   []string
	Refs      map[string]any
	Payload   map[string]any
}

type ExternalObjectResult 

type ExternalObjectResult struct {
	Hash string
	Path string
}

type FileBlameEntry 

type FileBlameEntry struct {
	File          string `json:"file"`
	AttemptID     string `json:"attempt_id"`
	RolloutID     string `json:"rollout_id"`
	ToolCallID    string `json:"tool_call_id"`
	SnapshotID    string `json:"snapshot_id"`
	IsWinner      bool   `json:"is_winner"`
	Changed       bool   `json:"changed"`
	Reason        string `json:"reason"`
	SHA256        string `json:"sha256"`
	Status        string `json:"status"`
	Strategy      string `json:"strategy"`
	Command       string `json:"command"`
	ArtifactRef   string `json:"artifact_ref,omitempty"`
	WorkspacePath string `json:"workspace_path"`
}

type FileBlameManifest 

type FileBlameManifest struct {
	SchemaVersion  string           `json:"schema_version"`
	RunID          string           `json:"run_id"`
	File           string           `json:"file"`
	BaseSnapshotID string           `json:"base_snapshot_id"`
	BaseSHA256     string           `json:"base_sha256"`
	Entries        []FileBlameEntry `json:"entries"`
}

func BuildBlameFile 

func BuildBlameFile(db *sql.DB, runID, filePath string) (FileBlameManifest, error)

type FileChangeSummary 

type FileChangeSummary struct {
	Created   int `json:"created"`
	Modified  int `json:"modified"`
	Deleted   int `json:"deleted"`
	Unchanged int `json:"unchanged"`
}

type FileDiffAttempt 

type FileDiffAttempt struct {
	AttemptID     string   `json:"attempt_id"`
	RolloutID     string   `json:"rollout_id"`
	ToolCallID    string   `json:"tool_call_id"`
	SnapshotID    string   `json:"snapshot_id"`
	WorkspacePath string   `json:"workspace_path"`
	Strategy      string   `json:"strategy"`
	Command       string   `json:"command"`
	Status        string   `json:"status"`
	IsWinner      bool     `json:"is_winner"`
	ArtifactRef   string   `json:"artifact_ref,omitempty"`
	Changed       bool     `json:"changed"`
	FileExists    bool     `json:"file_exists"`
	FileSHA256    string   `json:"file_sha256"`
	UnifiedDiff   []string `json:"unified_diff,omitempty"`
}

type FileDiffManifest 

type FileDiffManifest struct {
	SchemaVersion  string            `json:"schema_version"`
	RunID          string            `json:"run_id"`
	File           string            `json:"file"`
	BaseSnapshotID string            `json:"base_snapshot_id"`
	BasePath       string            `json:"base_path"`
	BaseExists     bool              `json:"base_exists"`
	BaseSHA256     string            `json:"base_sha256"`
	Attempts       []FileDiffAttempt `json:"attempts"`
}

func BuildDiffFile 

func BuildDiffFile(db *sql.DB, runID, filePath string) (FileDiffManifest, error)

type GraphLensEdge added in v0.4.0 

type GraphLensEdge struct {
	ID             string         `json:"id,omitempty"`
	FromID         string         `json:"from_id"`
	ToID           string         `json:"to_id"`
	EdgeType       string         `json:"edge_type"`
	SourceEventID  string         `json:"source_event_id,omitempty"`
	CreatedAt      string         `json:"created_at,omitempty"`
	Derived        bool           `json:"derived"`
	DerivationRule string         `json:"derivation_rule,omitempty"`
	Confidence     float64        `json:"confidence,omitempty"`
	EvidenceRefs   []string       `json:"evidence_refs,omitempty"`
	Data           map[string]any `json:"data,omitempty"`
}

type GraphLensManifest added in v0.4.0 

type GraphLensManifest struct {
	SchemaVersion   string             `json:"schema_version"`
	RunID           string             `json:"run_id"`
	Lens            string             `json:"lens"`
	AvailableLenses []string           `json:"available_lenses"`
	Query           GraphLensQuery     `json:"query"`
	Summary         []string           `json:"summary"`
	Nodes           []GraphLensNode    `json:"nodes"`
	Edges           []GraphLensEdge    `json:"edges"`
	DerivedEdges    []GraphLensEdge    `json:"derived_edges,omitempty"`
	Overlays        []GraphLensOverlay `json:"overlays,omitempty"`
}

func BuildGraphLens added in v0.4.0 

func BuildGraphLens(db *sql.DB, opts GraphLensOptions) (GraphLensManifest, error)

type GraphLensNode added in v0.4.0 

type GraphLensNode struct {
	ID          string         `json:"id"`
	Kind        string         `json:"kind"`
	Subtype     string         `json:"subtype,omitempty"`
	Label       string         `json:"label"`
	TrustOrigin string         `json:"trust_origin,omitempty"`
	Risk        string         `json:"risk,omitempty"`
	Data        map[string]any `json:"data,omitempty"`
}

type GraphLensOptions added in v0.4.0 

type GraphLensOptions struct {
	RunID    string
	Lens     string
	Focus    string
	Overlays []string
	Limit    int
	Detail   string
}

type GraphLensOverlay added in v0.4.0 

type GraphLensOverlay struct {
	TargetID string         `json:"target_id"`
	Kind     string         `json:"kind"`
	Label    string         `json:"label"`
	Severity string         `json:"severity,omitempty"`
	Data     map[string]any `json:"data,omitempty"`
}

type GraphLensQuery added in v0.4.0 

type GraphLensQuery struct {
	Focus         string   `json:"focus,omitempty"`
	Overlays      []string `json:"overlays,omitempty"`
	Limit         int      `json:"limit"`
	Detail        string   `json:"detail"`
	Truncated     bool     `json:"truncated"`
	NodeCount     int      `json:"node_count"`
	EdgeCount     int      `json:"edge_count"`
	Derived       int      `json:"derived_edge_count"`
	RawEventCount int      `json:"raw_event_count"`
	OmittedNodes  int      `json:"omitted_nodes,omitempty"`
	OmittedEdges  int      `json:"omitted_edges,omitempty"`
	LensRules     []string `json:"lens_rules"`
	LayoutHint    string   `json:"layout_hint"`
}

type MaterializeResult 

type MaterializeResult struct {
	RunID       string
	ObjectRoot  string
	ObjectCount int
	RootHashes  []string
}

type ObjectListManifest 

type ObjectListManifest struct {
	SchemaVersion string      `json:"schema_version"`
	RunID         string      `json:"run_id"`
	Limit         int         `json:"limit"`
	Cursor        string      `json:"cursor,omitempty"`
	NextCursor    string      `json:"next_cursor,omitempty"`
	HasMore       bool        `json:"has_more"`
	ResultSetID   string      `json:"result_set_id"`
	PageHash      string      `json:"page_hash"`
	ObjectCount   int         `json:"object_count"`
	Objects       []ObjectRef `json:"objects"`
}

func ListObjects 

func ListObjects(db *sql.DB, runID string) (ObjectListManifest, error)

func ListObjectsPage 

func ListObjectsPage(db *sql.DB, opts ObjectListOptions) (ObjectListManifest, error)

type ObjectListOptions 

type ObjectListOptions struct {
	RunID  string
	Limit  int
	Cursor string
}

type ObjectRef 

type ObjectRef struct {
	Hash         string `json:"hash"`
	Type         string `json:"type"`
	SourceID     string `json:"source_id"`
	RunID        string `json:"run_id"`
	RolloutID    string `json:"rollout_id"`
	ParentHashes string `json:"parent_hashes"`
	Path         string `json:"path"`
	SizeBytes    int64  `json:"size_bytes"`
	CreatedAt    string `json:"created_at"`
}

type ObjectStore 

type ObjectStore struct {
	DB    *sql.DB
	Paths store.Paths
}

func (ObjectStore) MaterializeRun 

func (s ObjectStore) MaterializeRun(runID string) (MaterializeResult, error)

func (ObjectStore) PutExternalObject 

func (s ObjectStore) PutExternalObject(input ExternalObjectInput) (ExternalObjectResult, error)

type OutboundObservation added in v0.7.2 

type OutboundObservation struct {
	Kind                  string // model_turn|artifact_upload|telemetry|analytics_payload|dns|network
	Host                  string
	Path                  string
	Bytes                 int
	Blocked               bool
	Redacted              bool
	Risky                 bool // metadata_ip / private_cidr / taint sink
	IsSourceCode          bool // git bundle / whole-repo payload
	HasSecret             bool // canary / secret markers observed in the payload
	HasBehavioralMetadata bool // inspected analytics payload contains identity/usage properties
	EvidenceRef           string
	Time                  string
	Note                  string
}

OutboundObservation is one normalized egress observation. The dashboard builds these from whatever the run recorded (endpoint captures, llm turns, dns/connect events); BuildOutboundSurfaces stays free of any storage or vendor knowledge beyond the owner registry, so it is unit-testable in isolation.

type OutboundSurface added in v0.7.2 

type OutboundSurface struct {
	ChannelClass     string   `json:"channel_class"`     // model_inference|artifact_storage|telemetry_service|product_analytics|external_api|database|tool_service|unknown_egress
	DataClass        string   `json:"data_class"`        // secret|source_code|conversation|behavioral_metadata|unknown
	Destination      string   `json:"destination"`       // observed host/endpoint (may be empty/unknown)
	DestinationOwner string   `json:"destination_owner"` // resolved via the owner registry
	EvidenceLevel    string   `json:"evidence_level"`    // payload_observed|connection_observed|dns_only|documented
	Decision         string   `json:"decision"`          // observed|allowed|blocked|redacted
	Risk             string   `json:"risk"`              // critical|high|medium|low (falls out of data_class+decision)
	RequestCount     int      `json:"request_count"`
	Bytes            int      `json:"bytes"`
	RiskCount        int      `json:"risk_count"`
	FirstSeen        string   `json:"first_seen"`
	LastSeen         string   `json:"last_seen"`
	Destinations     []string `json:"destinations"`  // all distinct hosts folded into this card
	DataClasses      []string `json:"data_classes"`  // all observed classes; DataClass is the highest-risk primary class
	EvidenceRefs     []string `json:"evidence_refs"` // node/event ids for the click-through DAG
	Note             string   `json:"note,omitempty"`
}

OutboundSurface is one aggregated "where data left (or tried to leave) the box" summary. Cards are generated from evidence, never hardcoded per demo: any run that produces outbound observations yields the surfaces those observations imply, and a run with no egress yields none. See BuildOutboundSurfaces.

func BuildOutboundSurfaces added in v0.7.2 

func BuildOutboundSurfaces(obs []OutboundObservation) []OutboundSurface

BuildOutboundSurfaces classifies each observation and aggregates by outbound channel, destination owner, and decision. Data classes remain a set inside the card, with the highest-risk class promoted as its primary label. Cards are ordered most-severe first.

type RecordBatchItem 

type RecordBatchItem struct {
	Index                   int      `json:"index"`
	JobID                   string   `json:"job_id,omitempty"`
	ShardID                 string   `json:"shard_id,omitempty"`
	RunID                   string   `json:"run_id,omitempty"`
	AttemptID               string   `json:"attempt_id,omitempty"`
	ToolCallID              string   `json:"tool_call_id,omitempty"`
	ProcessID               string   `json:"process_id,omitempty"`
	Workdir                 string   `json:"workdir,omitempty"`
	Command                 string   `json:"command,omitempty"`
	Status                  string   `json:"status"`
	ExitCode                int      `json:"exit_code"`
	WallMS                  int64    `json:"wall_ms"`
	ChangedFileCount        int      `json:"changed_file_count"`
	ChangedFiles            []string `json:"changed_files,omitempty"`
	Error                   string   `json:"error,omitempty"`
	EvidenceManifestCommand string   `json:"evidence_manifest_command,omitempty"`
	EvalContextCommand      string   `json:"eval_context_command,omitempty"`
	ExplainCommand          string   `json:"explain_command,omitempty"`
}

type RecordBatchManifest 

type RecordBatchManifest struct {
	SchemaVersion string            `json:"schema_version"`
	BatchID       string            `json:"batch_id"`
	InputSHA256   string            `json:"input_sha256"`
	StartedAt     string            `json:"started_at"`
	EndedAt       string            `json:"ended_at"`
	JobCount      int               `json:"job_count"`
	Passed        int               `json:"passed"`
	Failed        int               `json:"failed"`
	Skipped       int               `json:"skipped"`
	StatusCounts  map[string]int    `json:"status_counts"`
	RunIDs        []string          `json:"run_ids"`
	Shards        map[string]int    `json:"shards,omitempty"`
	Items         []RecordBatchItem `json:"items"`
	ResultSetID   string            `json:"result_set_id"`
	PageHash      string            `json:"page_hash"`
	CreatedAt     string            `json:"created_at"`
}

type RecordBatchSummaryManifest 

type RecordBatchSummaryManifest struct {
	SchemaVersion string            `json:"schema_version"`
	BatchID       string            `json:"batch_id"`
	RunID         string            `json:"run_id"`
	ItemCount     int               `json:"item_count"`
	Passed        int               `json:"passed"`
	Failed        int               `json:"failed"`
	Skipped       int               `json:"skipped"`
	StatusCounts  map[string]int    `json:"status_counts"`
	Shards        map[string]int    `json:"shards,omitempty"`
	Items         []RecordBatchItem `json:"items"`
	ResultSetID   string            `json:"result_set_id"`
	PageHash      string            `json:"page_hash"`
}

type RecordManifest 

type RecordManifest struct {
	SchemaVersion     string                  `json:"schema_version"`
	RunID             string                  `json:"run_id"`
	RolloutID         string                  `json:"rollout_id"`
	BaseSnapshotID    string                  `json:"base_snapshot_id"`
	AttemptID         string                  `json:"attempt_id"`
	SessionID         string                  `json:"session_id"`
	ToolCallID        string                  `json:"tool_call_id"`
	ProcessID         string                  `json:"process_id"`
	Workdir           string                  `json:"workdir"`
	Command           string                  `json:"command"`
	Status            string                  `json:"status"`
	ExitCode          int64                   `json:"exit_code"`
	WallMS            int64                   `json:"wall_ms"`
	ChangedFiles      []string                `json:"changed_files"`
	ChangedFileCount  int                     `json:"changed_file_count"`
	RootPID           int64                   `json:"root_pid"`
	ObservedProcesses []RecordObservedProcess `json:"observed_processes,omitempty"`
	OrphanPolicy      string                  `json:"orphan_policy"`
	PostRootGraceMS   int64                   `json:"post_root_grace_ms"`
	CWD               string                  `json:"cwd"`
	ProcessTreeCount  int                     `json:"process_tree_count"`
	TimeWindow        map[string]any          `json:"time_window"`
	ContextMode       string                  `json:"context_mode"`
	ScopeInference    map[string]any          `json:"scope_inference"`
}

func BuildRecordManifest 

func BuildRecordManifest(db *sql.DB, runID string) (RecordManifest, error)

type RecordObservedProcess 

type RecordObservedProcess struct {
	PID          int64  `json:"pid"`
	PPID         int64  `json:"ppid"`
	Command      string `json:"command"`
	FirstSeen    string `json:"first_seen"`
	LastSeen     string `json:"last_seen"`
	OutlivedRoot bool   `json:"outlived_root"`
}

type ReplayArtifactDigest 

type ReplayArtifactDigest struct {
	Path   string `json:"path"`
	Exists bool   `json:"exists"`
	SHA256 string `json:"sha256"`
	Bytes  int64  `json:"bytes"`
}

type ReplayAttemptPlan 

type ReplayAttemptPlan struct {
	ID               string                 `json:"id"`
	ExecutionID      string                 `json:"execution_scope_id"`
	BaseStateID      string                 `json:"base_state_id,omitempty"`
	SnapshotID       string                 `json:"snapshot_id"`
	ToolCallID       string                 `json:"tool_call_id,omitempty"`
	SubstrateScopeID string                 `json:"substrate_scope_id,omitempty"`
	Workspace        string                 `json:"workspace"`
	Strategy         string                 `json:"strategy"`
	Command          string                 `json:"command"`
	Status           string                 `json:"status"`
	RiskStatus       string                 `json:"risk_status"`
	ArtifactResult   string                 `json:"artifact_result,omitempty"`
	ArtifactDigest   *ReplayArtifactDigest  `json:"artifact_digest,omitempty"`
	IsWinner         bool                   `json:"is_winner"`
	BudgetExceeded   bool                   `json:"budget_exceeded"`
	ReplayBlocked    bool                   `json:"replay_blocked"`
	BlockReasons     []string               `json:"block_reasons,omitempty"`
	Score            float64                `json:"score"`
	CostEstimate     float64                `json:"cost_estimate"`
	ToolCall         *ReplayToolCall        `json:"tool_call,omitempty"`
	Processes        []ReplayProcess        `json:"processes,omitempty"`
	ExternalEffects  []ReplayExternalEffect `json:"external_effects,omitempty"`
	Events           []ReplayEvent          `json:"events,omitempty"`
}

type ReplayEvent 

type ReplayEvent struct {
	ID                    string  `json:"id"`
	EventType             string  `json:"event_type"`
	Source                string  `json:"source"`
	ProcessID             string  `json:"process_id,omitempty"`
	SnapshotID            string  `json:"snapshot_id,omitempty"`
	CorrelationMethod     string  `json:"correlation_method,omitempty"`
	CorrelationConfidence float64 `json:"correlation_confidence"`
	Payload               string  `json:"payload"`
}

type ReplayExternalEffect 

type ReplayExternalEffect struct {
	ID              string `json:"id"`
	EffectType      string `json:"effect_type"`
	Target          string `json:"target"`
	Mode            string `json:"mode"`
	Decision        string `json:"decision"`
	CompensationRef string `json:"compensation_ref,omitempty"`
	Status          string `json:"status"`
	Payload         string `json:"payload"`
}

type ReplayManifest 

type ReplayManifest struct {
	SchemaVersion string          `json:"schema_version"`
	Mode          string          `json:"mode"`
	Scope         string          `json:"scope"`
	RunID         string          `json:"run_id,omitempty"`
	AttemptID     string          `json:"attempt_id,omitempty"`
	ExecutionID   string          `json:"execution_scope_id,omitempty"`
	Trajectories  []ReplayRollout `json:"trajectories"`
	Rollouts      []ReplayRollout `json:"rollouts"`
}

func BuildReplayAttempt 

func BuildReplayAttempt(db *sql.DB, attemptID string) (ReplayManifest, error)

func BuildReplayRun 

func BuildReplayRun(db *sql.DB, runID string) (ReplayManifest, error)

type ReplayProcess 

type ReplayProcess struct {
	ID        string `json:"id"`
	SessionID string `json:"session_id"`
	Command   string `json:"command"`
	Status    string `json:"status"`
	ExitCode  int64  `json:"exit_code"`
	StartedAt string `json:"started_at"`
	EndedAt   string `json:"ended_at"`
}

type ReplayRollout 

type ReplayRollout struct {
	ID              string              `json:"id"`
	TrajectoryID    string              `json:"trajectory_id"`
	RunID           string              `json:"run_id"`
	BaseStateID     string              `json:"base_state_id"`
	BaseSnapshotID  string              `json:"base_snapshot_id"`
	Status          string              `json:"status"`
	SelectedScopeID string              `json:"selected_execution_scope_id"`
	WinnerAttemptID string              `json:"winner_attempt_id"`
	PromotionID     string              `json:"promotion_id"`
	RiskStatus      string              `json:"risk_status"`
	BaseState       *ReplaySnapshot     `json:"base_state,omitempty"`
	ExecutionScopes []ReplayAttemptPlan `json:"execution_scopes"`
	BaseSnapshot    *ReplaySnapshot     `json:"base_snapshot,omitempty"`
	Attempts        []ReplayAttemptPlan `json:"attempts"`
}

type ReplaySnapshot 

type ReplaySnapshot struct {
	ID           string `json:"id"`
	Name         string `json:"name"`
	Kind         string `json:"kind"`
	PhysicalType string `json:"physical_type"`
	Path         string `json:"path"`
	ManifestHash string `json:"manifest_hash"`
	FileCount    int64  `json:"file_count"`
	Bytes        int64  `json:"bytes"`
	Status       string `json:"status"`
	Tainted      bool   `json:"tainted"`
}

type ReplayToolCall 

type ReplayToolCall struct {
	ID             string  `json:"id"`
	SessionID      string  `json:"session_id"`
	Command        string  `json:"command"`
	Status         string  `json:"status"`
	ExitCode       int64   `json:"exit_code"`
	WallMS         int64   `json:"wall_ms"`
	CostEstimate   float64 `json:"cost_estimate"`
	ResultRef      string  `json:"result_ref,omitempty"`
	PolicyDecision string  `json:"policy_decision"`
	StartedAt      string  `json:"started_at"`
	EndedAt        string  `json:"ended_at"`
}

type TimelineEvent 

type TimelineEvent struct {
	Time              string             `json:"time"`
	Type              string             `json:"type"`
	Source            string             `json:"source"`
	Lane              string             `json:"lane,omitempty"`
	CorrelationStatus string             `json:"correlation_status,omitempty"`
	ID                string             `json:"id"`
	RunID             string             `json:"run_id"`
	SessionID         string             `json:"session_id,omitempty"`
	AttemptID         string             `json:"attempt_id,omitempty"`
	ToolCallID        string             `json:"tool_call_id,omitempty"`
	ProcessID         string             `json:"process_id,omitempty"`
	SnapshotID        string             `json:"snapshot_id,omitempty"`
	ObjectRef         string             `json:"object_ref,omitempty"`
	Summary           string             `json:"summary"`
	Evidence          map[string]any     `json:"evidence,omitempty"`
	Risk              map[string]any     `json:"risk,omitempty"`
	ExplainReplayRefs []ExplainReplayRef `json:"replay_refs,omitempty"`
	Drilldowns        []string           `json:"drilldowns,omitempty"`
}

type TimelineFilter 

type TimelineFilter struct {
	ToolCall  string `json:"tool_call_id,omitempty"`
	ProcessID string `json:"process_id,omitempty"`
	Type      string `json:"type,omitempty"`
	Limit     int    `json:"limit,omitempty"`
	Cursor    string `json:"cursor,omitempty"`
	View      string `json:"view,omitempty"`
}

type TimelineManifest 

type TimelineManifest struct {
	SchemaVersion string          `json:"schema_version"`
	RunID         string          `json:"run_id"`
	Filter        TimelineFilter  `json:"filter"`
	View          string          `json:"view"`
	Summary       TimelineSummary `json:"summary"`
	ResultSetID   string          `json:"result_set_id"`
	PageHash      string          `json:"page_hash"`
	Cursor        string          `json:"cursor,omitempty"`
	NextCursor    string          `json:"next_cursor,omitempty"`
	HasMore       bool            `json:"has_more"`
	TotalCount    int             `json:"total_count"`
	EventCount    int             `json:"event_count"`
	Events        []TimelineEvent `json:"events"`
}

func BuildTimeline 

func BuildTimeline(db *sql.DB, opts TimelineOptions) (TimelineManifest, error)

type TimelineOptions 

type TimelineOptions struct {
	RunID     string
	ToolCall  string
	ProcessID string
	Type      string
	Limit     int
	Cursor    string
	View      string
}

type TimelineSummary 

type TimelineSummary struct {
	TotalEvents         int            `json:"total_events"`
	LaneCounts          map[string]int `json:"lane_counts"`
	RuntimeEvents       int            `json:"runtime_events"`
	FullyCorrelated     int            `json:"fully_correlated"`
	PartiallyCorrelated int            `json:"partially_correlated"`
	CorrelationGaps     int            `json:"correlation_gaps"`
}

type TrajectoryEvidence 

type TrajectoryEvidence struct {
	RunID                  string                 `json:"run_id"`
	RolloutID              string                 `json:"rollout_id"`
	AttemptID              string                 `json:"attempt_id"`
	SnapshotID             string                 `json:"snapshot_id"`
	ToolCallID             string                 `json:"tool_call_id,omitempty"`
	Workspace              string                 `json:"workspace"`
	Strategy               string                 `json:"strategy"`
	Command                string                 `json:"command"`
	Status                 string                 `json:"status"`
	RiskStatus             string                 `json:"risk_status"`
	LocalCandidateEligible bool                   `json:"local_candidate_eligible"`
	ReplayBlocked          bool                   `json:"replay_blocked"`
	BlockReasons           []string               `json:"block_reasons,omitempty"`
	Score                  float64                `json:"score"`
	CostEstimate           float64                `json:"cost_estimate"`
	ArtifactResult         string                 `json:"artifact_result,omitempty"`
	ArtifactDigest         *ReplayArtifactDigest  `json:"artifact_digest,omitempty"`
	ToolCall               *ReplayToolCall        `json:"tool_call,omitempty"`
	Processes              []ReplayProcess        `json:"processes,omitempty"`
	RuntimeEvents          []ReplayEvent          `json:"runtime_events,omitempty"`
	ExternalEffects        []ReplayExternalEffect `json:"external_effects,omitempty"`
	FileChanges            []TrajectoryFileChange `json:"file_changes,omitempty"`
	FileChangeSummary      FileChangeSummary      `json:"file_change_summary"`
}

type TrajectoryFileChange 

type TrajectoryFileChange struct {
	Path        string   `json:"path"`
	ChangeType  string   `json:"change_type"`
	BaseExists  bool     `json:"base_exists"`
	NextExists  bool     `json:"next_exists"`
	BaseSHA256  string   `json:"base_sha256"`
	NextSHA256  string   `json:"next_sha256"`
	BaseBytes   int64    `json:"base_bytes"`
	NextBytes   int64    `json:"next_bytes"`
	UnifiedDiff []string `json:"unified_diff,omitempty"`
}

type TrajectoryManifest 

type TrajectoryManifest struct {
	SchemaVersion string               `json:"schema_version"`
	RunID         string               `json:"run_id"`
	DecisionOwner string               `json:"decision_owner"`
	Rollouts      []TrajectoryRollout  `json:"rollouts"`
	Trajectories  []TrajectoryEvidence `json:"trajectories"`
}

func BuildTrajectoriesRun 

func BuildTrajectoriesRun(db *sql.DB, runID string) (TrajectoryManifest, error)

type TrajectoryRollout 

type TrajectoryRollout struct {
	ID             string          `json:"id"`
	BaseSnapshotID string          `json:"base_snapshot_id"`
	Status         string          `json:"status"`
	LocalCandidate string          `json:"local_candidate,omitempty"`
	PromotionID    string          `json:"promotion_id,omitempty"`
	RiskStatus     string          `json:"risk_status"`
	BaseSnapshot   *ReplaySnapshot `json:"base_snapshot,omitempty"`
}

type VerifyIssue 

type VerifyIssue struct {
	Severity string `json:"severity"`
	Kind     string `json:"kind"`
	ID       string `json:"id"`
	Message  string `json:"message"`
}

type VerifyResult 

type VerifyResult struct {
	SchemaVersion string        `json:"schema_version"`
	RunID         string        `json:"run_id"`
	Status        string        `json:"status"`
	IssueCount    int           `json:"issue_count"`
	ErrorCount    int           `json:"error_count"`
	WarningCount  int           `json:"warning_count"`
	Issues        []VerifyIssue `json:"issues"`
}

func Verify 

func Verify(db *sql.DB, runID string) (VerifyResult, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.