docs(roadmap): Epic B slices B2-B7 — classify/attest/adopt/govern/macOS/Windows plans

[gnanirahulnutakki]

Planning document only — no code changed, no work authorized. Adds docs/roadmap/epic-b-b2-b7-slice-plans.md, the file-level build plans for the remaining Epic B slices after B1.

Grounded in the merged Epic B docs — slice plan (#114), policy-selection research (#116, the AG-0…AG-4 ladder + binding registry + two-claim verifier + deltas D1–D7), cost/reliability SLOs (#117) — the B1 detail (#120), and the current code (es_client_darwin.go, passport.py, bpf_lower.py, run_bridge.py, enforce_receipt_chain.go). No dedicated Linux-fingerprinting or macOS/Windows research doc is merged/open, so B2's fingerprint design and B6/B7 are built from the roadmap §2.2/§2.3 + #106 + #117's evasion taxonomy, with a note to reconcile if those land.

Invariants carried through all six slices

Provenance passport ≠ mission grant · INSUFFICIENT_EVIDENCE for intent, never COMPLIANT · observe-first, enforce only on an operator declaration, fail-safe = observe · loud-abort inversion (auto can't kill what it didn't start → fall to shadow) · every fail-safe is a measured event.

Slice-by-slice

• B2 classify ([A] Auto-recognition + classification of AI agents on launch #67): agent_classifier.py + labeled corpus + fingerprint table (single source of truth as data, thin Go evaluator in the daemon). Static multi-signal (basename+hash+argv); interpreter hole measured via Land the live Linux eBPF capture daemon + emit the observability-gap metric #39, not closed. Gates: SLO-5 (precision ≥0.99, =1.00 on node/python/git/bash), SLO-7 (recall ≥0.95). Observe-only.
• B3 auto-attest ([A] Automatic attestation of detected agents (no manual hook) #68): provenance_passport.py — host-key-signed observation credential, schema-distinct from MissionPassport; verifier ProvenanceNotAMissionError reject + mission_compliance=INSUFFICIENT_EVIDENCE (Invariants 1–2 as tested exceptions); folds into the feat(enforce): sequence, hash-chain, and attest kernel enforce_events (Epic A E3) #100 hash chain; binding_strength: "process" (weaker than PoP, stated honestly). Observe-only.
• B4 adopt-and-attach: adopt_cgroup_linux.go — migrate a running process tree into a managed cgroup via a bounded reconciliation sweep; un-adoptable → observe-only, loudly; no security(enforce): concurrent apply_policy races the double-buffer active_slot swap (CWE-362) #110 race; applies no policy. New adopt-smoke CI.
• B5 auto-govern ([A] Wire the full governance cycle to auto-detected agents #69) — first no-wrapper enforcement: agent_bindings.py (TOML registry, load-time dry-run lowering, ambiguity-resolves-downward), synthesized_mission.py (AG-2 shadow, SynthesizedMissionEnforceError), two-claim verifier (class_policy_compliance vs mission_compliance), auto_govern.go (reuses apply_policy feat(run): wire apply_policy — lowered BPF plans reach the kernelcapture daemon #96 verbatim; loud-abort inversion). Hard deps: [A] E4 — seccomp user-notify enforcement tier for bpf_lower's tier2_ops #104 (seccomp tier-2) + [A] Reconcile bpf_lower.py file-op ACT_ALLOWLIST lowering with guard_file_open's fail-closed LPM restriction #105 (file-op reconcile); trustworthiness leans on enforce: fail-open if the BPF-LSM guard consumer dies after startup — activeTier stays bpf_lsm, guard detached #121/enforce: BPF-LSM guard is unpinned — daemon restart drops all enforcement with no re-apply mechanism #124. Implements deltas D1–D7 (D4 deferrable). Gates SLO-6. New auto-govern-smoke e2e.
• B6 macOS ESF ([A] macOS: Endpoint Security Framework process detection #70/[A] Slice 2 remainder — macOS launchd packaging + ES System Extension + Apple ES entitlement filing #106): real es_client_darwin.go (cgo, es_new_client + NOTIFY_EXEC) → reuse B2/B3; enforce tier = ESF AUTH + Network Extension (coarser, per-audit-token, no cgroup). NOTIFY-detect only (SLO-8), AUTH reserved for enforce (p99 ≤5ms, fail-open-to-observe). Hard dep [A] Slice 2 remainder — macOS launchd packaging + ES System Extension + Apple ES entitlement filing #106 Apple entitlement — file at B1 start (external lead time). CI limit stated honestly: hosted macOS runners can't load a System Extension → live proof is self-hosted/signed-Mac.
• B7 Windows ETW ([A] Windows: process detection (future) #71): etw_source_windows.go (Kernel-Process provider) → reuse B2/B3. Detect + attest only; no enforcement (needs a driver track — out of scope), documented plainly. Ordered after B6 per [A] Windows: process detection (future) #71. Hosted windows-latest CI works (no driver).

Critical path to the first no-wrapper enforcement demo

B1 → B2 → B3 → B4 → B5, with #104 + #105 before B5. B4 parallels B2/B3. B5 is the join and the first slice that enforces on an un-wrapped agent (auto-govern-smoke). Off the path: #106 (start the Apple filing at B1 kickoff — lead time, not code, gates B6) and #121/#124 (recommended before AG-3 enforce GA; AG-2 shadow default doesn't need them). Before B5: an ADR on the honest enforcement ceiling of a proxy-less agent (AG-3 "enforced" is a weaker claim than wrapped --enforce — shapes the headline, AuditBench, and paper-lane narrative).