Port backend remainder: submissions, orchestrator, reports generation, host-local signals, settings admin APIs

[Xore]

Split out of #1608's handoff so this can run in parallel with the visual completion pass (in progress on port-foundation — coordinate by rebasing on that branch; frontend routes and small READ endpoints are being handled there, this issue owns the write paths, workers, and host-coupled backends).

Scope (work directly on port-foundation, Rust tier arcane/home/honeypot-dashboard/backend-service/)

1. Mounted worker role (spool-dir flows)

The legacy Go dashboard writes/reads host spool dirs (see the dashboard service volumes in arcane/home/honeypot-dashboard/compose.yml). Add a mounted variant of the backend-worker compose service and port:

• Sandbox submission: POST writes a request file into SANDBOX_REQUEST_DIR (+ windows/ghosts variants), status from the worker's status file (sandbox.go / sandbox_submit.go / sandbox_golden_image_status).
• Ghidra submission (ghidra_submit.go) and GitHub-analysis submission (github_analysis_submit.go) — same request-spool pattern.
• Workbench orchestrator (workbench_orchestrator.go, ~590 lines): recipe → child analyzer runs → spools, state in dashboard-workbench-runs-v1.
• On-demand payload bytes mirror (payload_bytes_es.go mirrorOnePayloadBytes): static analysis path self-heal.
• Expose all as /api/v1/* endpoints behind the existing service-token middleware.

2. Reports generation

• Port report_pdf.go (849 lines: composer, brandmark, watermark) + reports_scheduler.go into the Rust tier (or a deliberate matrix decision to keep the reporter worker — document it on Port follow-up: migrate every worker into the new BFF/service architecture; BFF scalability #1610 if so).
• Definitions CRUD API (dashboard-reports-definitions-v1) + on-demand generate endpoint writing pdf_base64 into dashboard-generated-reports-v1 (streaming/list/UI already ported).

3. Alert notifier host-local signals (extend src/worker.rs)

ES-derivable signals are done. Missing (all need mounts or service URLs):

• log-stream size alerts (scanLogStreams over LOG_DIR, thresholds LOG_STREAM_MAX_BYTES / LOG_STREAM_ALERT_PERCENT)
• sandbox/ghidra spool + worker-status health (loadSandboxStatus / loadGhidraStatus)
• filebeat stats via FILEBEAT_URL (ingestion-unhealthy / filebeat-loss alerts)
• cape/github-analysis alert emitters (capeAlerts / githubAnalysisAlerts)
• OT command alerts (T1692.001 per source — can be ES-derived from honeypot.canonical_attck_techniques, no mount needed)

4. Settings admin backend APIs

• Services control through the services-adapter socket (settings_services_api.go; tier decision — the socket is host-local)
• Retention settings (settings_retention / ES ILM), config history + rollback (settings_history.go), audit trail (settings_audit.go)
• Per-user preference sync: read/write the per-subject preferences blob in dashboard-users-v1 (settings_users.go) — the ported UI currently keeps theme/palette/prefetch in localStorage only; add GET/PUT /api/v1/preferences so prefs follow the operator across browsers
• Reporter stats passthrough (settings_reporter_stats_api.go)

5. Misc write paths

• honeyfs-implant credential provisioning/rotation passthrough (honeyfs_implant_client.go; HONEYFS_IMPLANT_URL, off-unless-configured)
• Canarytokens: fired-event ack/management beyond mint+download if the legacy UI has any (canarytokens_manager.go)

Explicitly NOT in this issue (being done in the visual pass right now — avoid collisions)

• Frontend routes/components, and these small READ endpoints: sandbox-run-by-job, ghidra-by-sha, revdeck/cape/github store passthroughs, attackers-graph, attack-vectors drill-down, ML anomaly ack (single-doc update, mirrors alert ack).

Conventions

• Tests: extend arcane/home/honeypot-dashboard/port-tests/ (README has the harness contract; live ES via ssh -N -L 19200:172.16.1.12:9200 xore@192.168.42.250; writes only to TEST-NET/test values, restore state).
• honeypot.* is flattened (no wildcard/stats aggs); prefer honeypot.canonical_* fields.
• Same-image worker roles via WORKER_LOOPS env; keep every service stateless/env-configured (cross-host requirement, see Port follow-up: migrate every worker into the new BFF/service architecture; BFF scalability #1610).

🤖 Generated with Claude Code

[Xore]

Implemented and merged into `port-foundation` via #1613 (10 commits).

What shipped

1. Settings admin backend APIs — services control (Unix-socket passthrough to hp-services-adapter), config revision history + rollback, audit trail, per-subject preference sync (GET/PUT /api/v1/preferences), reporter-stats passthrough, user-retention-sweep worker loop.

2. Alert notifier host-local signals — OT command alerts (T1692.001), log-stream size alerts, sandbox/ghidra/cape/github-analysis spool health, filebeat ingestion stats — all added to the existing alert-notifier worker loop.

3. Mounted worker role — sandbox/ghidra/github-analysis submission endpoints, golden-image status, on-demand payload-bytes ES self-heal, and the full Payload Workbench orchestrator (recipes, run creation/reconciliation, child cancel/retry) on a new backend-service-mounted compose service (tier decision: write access to host spool dirs needed its own mount boundary, separate from the stateless backend-service/backend-worker).

4. Reports generation — PDF composer, definitions CRUD, ES-driven report data gathering (replacing the Go tier's in-memory event cache with real aggregations), on-demand generate endpoint, and a scheduler worker loop. The composer started as a hand-rolled raw-PDF writer (matching the Go source's own approach) and was swapped to vendored printpdf for long-term maintainability once the full pipeline was verified working. The three artifact-referenced templates (sandbox/payload/ghidra one-click reports) validate/save but generate returns 501 — their dedicated renderers (sandbox_pdf.go/ghidra_pdf.go/a payload equivalent) weren't ported this pass.

5. Misc write paths — honeyfs-implant credential provisioning/rotation (GET/POST /api/v1/credentials, rotate, link-token), plus a small canarytokens history-list gap found along the way (GET /api/v1/canarytokens, with auth_token correctly redacted). Confirmed the "fired-event ack" feature this section's second bullet asked about doesn't exist anywhere in the Go source — fired tokens surface as ordinary honeypot events, acked via the already-ported POST /api/v1/alerts/{key}/ack.

Explicitly deferred (not silent gaps)

• The 3 artifact-referenced report templates' dedicated PDF renderers (sandbox/payload/ghidra).
• payloadPathBySHA256's Dionaea MD5-vs-SHA256 content-scan fallback (a hash not matching any filename directly returns not-found).
• Byte-fingerprint staleness recheck on an already-ES-mirrored payload (payload_bytes.rs).
• Beelzebub's passwordRegex config-rewrite credential target (Go itself only wires up cowrie_honeyfs today).
• BFF/frontend wiring for all of the above — owned by the parallel visual-completion track per this issue's own coordination note.

Verification

cargo build/cargo test clean at every step, real multi-page PDFs generated and validated with poppler (pdfinfo/pdftotext/pdfimages), ES field names/index names cross-checked against the existing Go source and this crate's established conventions (caught and fixed two real bugs in review: a risk-score scale mismatch and a wrong ES field name), docker compose --profile next config resolved cleanly throughout, full CI green on the PR. No live ES/services-adapter/host-mount environment was reachable during development — live smoke testing against the real stack is still needed before cutover.

Closing — all 5 sections of this issue's scope are done.