Skip to content

TASK-0019: Bound NetGuard reality reporting after core polls - #9

Merged
lr00rl merged 1 commit into
integrationfrom
feat/hephaestus-task0019-netguard-reality-poll
Aug 4, 2026
Merged

TASK-0019: Bound NetGuard reality reporting after core polls#9
lr00rl merged 1 commit into
integrationfrom
feat/hephaestus-task0019-netguard-reality-poll

Conversation

@lr00rl

@lr00rl lr00rl commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Result

  • Adds disabled-by-default --report-guard-reality / LATTICE_REPORT_GUARD_REALITY=1.
  • Collects one complete low-trust snapshot and posts it to /api/agent/guard-reality.
  • Sends nothing on collector failure and surfaces collection/transport errors.
  • Runs after task, monitor, log-source, and debug work with one 10-second collection+POST deadline.
  • Reuses existing node identity and bearer transport without auth changes.

Verification

  • Focused normal and race TestReportGuardReality runs passed.
  • gopls check passed for both changed Go files.
  • scripts/check-release-workflow.sh passed.
  • scripts/test-install-integrity.sh passed.
  • go vet ./... passed.
  • go test -race -cover ./... -count=1 passed (cmd/lattice-agent 34.2%, internal/guardreality 81.1%).
  • Exact Allowed-path and staged redaction scans passed.

Boundaries

No SDK/proto, server, auth timing, workflow, install/release, signing, nft mutation, or deployment changes. Live host discovery and cross-process agent-to-server execution were intentionally not run.

Wire the existing fail-whole collector to the accepted agent endpoint behind an explicit local opt-in. Run the report after core poll work and share a ten-second deadline across collection and POST so degraded discovery or transport remains visible without delaying task, monitor, and log-source service in the current cycle.

Constraint: Existing bearer authentication and server payload contracts must remain unchanged
Constraint: Partial collector output must never be reported as node ground truth
Rejected: Fire-and-forget reporting | overlapping host discovery would lose per-cycle ordering and error ownership
Rejected: Reuse the shared 30-second request ceiling synchronously | optional reporting could starve core poll work
Confidence: high
Scope-risk: moderate
Directive: Keep guard reality low-trust and fail-whole; do not move it before core poll operations without re-evaluating latency
Tested: Focused normal and race tests; next-cycle recovery and deadline tests; gopls; release-workflow check; install-integrity check; go vet ./...; go test -race -cover ./...; allowed-path and redaction scans
Not-tested: Live ss/ip/nft discovery and a cross-process agent-to-server run were intentionally not executed
@lr00rl
lr00rl merged commit bbcc26c into integration Aug 4, 2026
1 check passed
@lr00rl
lr00rl deleted the feat/hephaestus-task0019-netguard-reality-poll branch August 4, 2026 07:25
@lr00rl

lr00rl commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Landed on integration as bbcc26c8fa271f3ae2f068ca10f2ed7b6d55372f. The acknowledged feature head c1c2161350aebc07bc1c403b2538a1d1b1cdfbae is the exact second parent, the first parent is reviewed base 3e505d66c3a6982e680107edc0f4d816f11adea3, and the merge tree is identical to the reviewed feature tree. Final full local gates and the post-merge go test ./... -count=1 quick regression passed.

@lr00rl
lr00rl restored the feat/hephaestus-task0019-netguard-reality-poll branch August 4, 2026 07:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant