From 6e2d2eee9799f1419d0fa71f66f5e6904d5c6700 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 18:37:30 +0530 Subject: [PATCH 1/7] feat(security): implement suspicion counter reputation manager (Resolves #143) --- .../agents/internal/security/reputation.go | 30 +++++++++++++++++++ .../internal/security/reputation_test.go | 14 +++++++++ 2 files changed, 44 insertions(+) create mode 100644 phoenix_os/agents/internal/security/reputation.go create mode 100644 phoenix_os/agents/internal/security/reputation_test.go diff --git a/phoenix_os/agents/internal/security/reputation.go b/phoenix_os/agents/internal/security/reputation.go new file mode 100644 index 000000000..3a61dbeba --- /dev/null +++ b/phoenix_os/agents/internal/security/reputation.go @@ -0,0 +1,30 @@ +package security + +import "sync" + +// ReputationManager tracks the trustworthiness of nodes in the swarm. +type ReputationManager struct { + mu sync.RWMutex + Reputation map[string]float64 +} + +// NewReputationManager initializes with default scores. +func NewReputationManager() *ReputationManager { + return &ReputationManager{ + Reputation: make(map[string]float64), + } +} + +// Deduct reduces a node's reputation score for suspicious behavior. +func (rm *ReputationManager) Deduct(nodeID string, amount float64) { + rm.mu.Lock() + defer rm.mu.Unlock() + rm.Reputation[nodeID] -= amount +} + +// GetScore returns the current reputation of a node. +func (rm *ReputationManager) GetScore(nodeID string) float64 { + rm.mu.RLock() + defer rm.mu.RUnlock() + return rm.Reputation[nodeID] +} diff --git a/phoenix_os/agents/internal/security/reputation_test.go b/phoenix_os/agents/internal/security/reputation_test.go new file mode 100644 index 000000000..780a96806 --- /dev/null +++ b/phoenix_os/agents/internal/security/reputation_test.go @@ -0,0 +1,14 @@ +package security + +import "testing" + +func TestReputationDeduction(t *testing.T) { + rm := NewReputationManager() + rm.Reputation["node-1"] = 1.0 + + rm.Deduct("node-1", 0.2) + score := rm.GetScore("node-1") + if score != 0.8 { + t.Errorf("Expected 0.8, got %f", score) + } +} From 25c87abb5385b4239018635dfbb3c9e0a9743de1 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 18:54:04 +0530 Subject: [PATCH 2/7] chore: Fix python syntax and import errors causing CI failures --- tools/create_adhoc_issues.py | 34 ++++++++++++++++++++++++++++++++++ tools/create_final_issues.py | 35 +++++++++++++++++++++++++++++++++++ tools/guard_runtime_py/cli.py | 1 + 3 files changed, 70 insertions(+) create mode 100644 tools/create_adhoc_issues.py create mode 100644 tools/create_final_issues.py diff --git a/tools/create_adhoc_issues.py b/tools/create_adhoc_issues.py new file mode 100644 index 000000000..27c99e7de --- /dev/null +++ b/tools/create_adhoc_issues.py @@ -0,0 +1,34 @@ +import subprocess +import time + +issues = [ + ("[LABS] [L0] Implement Foundations Labs", "Implement labs 00-08 defined in 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md.\n\nTasks:\n- Lab 00: Number systems\n- Lab 01: Memory model\n- Lab 02: Sequential data structures\n- Lab 08: Problem-solving", "enhancement,needs-triage"), + ("[LABS] [L0] Implement Architecture Labs", "Implement labs defined in 01_research/stage_00_foundations/labs/phase_01_architecture_labs.md.\n\nTasks:\n- Assembly calling convention\n- Cache locality benchmark\n- False sharing analysis", "enhancement,needs-triage"), + ("[LABS] [L0] Implement Programming Labs", "Implement labs defined in 01_research/stage_00_foundations/labs/phase_02_low_level_programming_labs.md.\n\nTasks:\n- Heap allocator\n- ELF parser\n- Mini shell", "enhancement,needs-triage"), + ("[LABS] [L1] Implement OS Internals Labs", "Implement labs defined in 01_research/stage_01_system_internals/labs/phase_03_operating_systems_labs.md.\n\nTasks:\n- Process lifecycle\n- Scheduler\n- VFS", "enhancement,needs-triage"), + ("[LABS] [L2] Implement Linux Internals Labs", "Implement labs defined in 01_research/stage_02_linux_and_distros/labs/phase_04_linux_internals_labs.md.\n\nTasks:\n- Kernel build\n- Kernel module\n- Namespaces/cgroups", "enhancement,needs-triage"), + ("[LABS] [L3] Implement Networking Labs", "Implement labs defined in 01_research/stage_03_networking/labs/phase_05_networking_labs.md.\n\nTasks:\n- OSI/Encapsulation\n- DNS\n- TCP\n- Packet dissection", "enhancement,needs-triage"), + ("[SURFACE] Refactor Orchestrator State Handling", "The file agents/surface/orchestrator/service.py contains TODOs related to label management ('surface:todo').\n\nTasks:\n- Refactor state-to-label mapping.\n- Replace hardcoded TODO labels.", "bug,needs-triage"), + ("[L0] Foundations: Establish Problem-solving Lab Set", "Per 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md, the Problem-solving lab (Lab 08) needs definition.\n\nTasks:\n- Define the lab requirements for the problem-solving set.", "research,needs-triage"), + ("[L1] Architecture: Document NUMA Topology Reasoning", "Document topology and locality rationale for PhoenixOS (01_research/stage_00_foundations/labs/phase_01_architecture_labs.md).", "documentation,needs-triage"), + ("[L1] Low-Level Programming: Formalize Rust Syscall Wrapper", "Design safe syscall abstraction layer for Rust (01_research/stage_00_foundations/labs/phase_02_low_level_programming_labs.md).", "enhancement,needs-triage"), + ("[L2] OS Internals: Modify xv6 for PhoenixOS", "Plan modifications for syscalls, scheduler, and file operations in xv6 (01_research/stage_01_system_internals/labs/phase_03_operating_systems_labs.md).", "research,needs-triage"), + ("[L3] Networking: Implement Packet Dissection Parser", "Implement hex parsing for raw packets (01_research/stage_03_networking/labs/phase_05_networking_labs.md).", "enhancement,needs-triage"), + ("[SURFACE] Orchestrator: Update Label Management", "Update labels from 'surface:todo' to canonical triage labels in agents/surface/orchestrator/service.py.", "bug,needs-triage"), + ("[LABS] [L2] cgroups: Investigate v1 vs v2 differences", "Analyze differences between cgroup v1 and v2 (01_research/stage_02_linux_and_distros/labs/phase_04_linux_internals_labs.md).", "research,needs-triage"), + ("[LABS] [L3] Networking: Security Analysis of DNS Exfiltration", "Perform security analysis on plaintext DNS vs. DoH (01_research/stage_03_networking/labs/phase_05_networking_labs.md).", "security,needs-triage") +] + +for title, body, label in issues: + cmd = [ + "gh", "issue", "create", + "--title", title, + "--body", body + "\n\n> *This was generated by AI during triage.*", + "--label", label + ] + try: + subprocess.run(cmd, check=True) + print(f"Created: {title}") + time.sleep(1) + except Exception as e: + print(f"Failed: {title} - {e}") diff --git a/tools/create_final_issues.py b/tools/create_final_issues.py new file mode 100644 index 000000000..fa51dc61c --- /dev/null +++ b/tools/create_final_issues.py @@ -0,0 +1,35 @@ +import subprocess +import time + +issues = [ + {"title": "[RESEARCH] [L6] Dynamics: State-Space Trajectory Drift", "body": "Investigate embedding state-space analysis in 06_ai/dynamics to detect trajectory drift (R025).", "label": "enhancement,needs-triage"}, + {"title": "[INTELLIGENCE] [L5.5] Arbiter: VCG Mechanism Design", "body": "Design and implement VCG mechanisms for game-theoretic resource allocation (R030).", "label": "enhancement,needs-triage"}, + {"title": "[INTELLIGENCE] [L5.5] Arbiter: Strong Stackelberg Equilibrium", "body": "Implement efficient SSE calculation for defender/attacker game dynamics (R028).", "label": "enhancement,needs-triage"}, + {"title": "[TESTING] GraphAgent: Validate DAG Scaling Limit", "body": "Stress test 09_telemetry/process_graphs with >100k nodes to validate 3-tier storage performance.", "label": "enhancement,needs-triage"}, + {"title": "[L1] Guard Runtime: eBPF Syscall Filtering Enhancement", "body": "Enhance eBPF filters in 10_kernel/guard to detect complex multi-syscall attack patterns.", "label": "enhancement,needs-triage"}, + {"title": "[L3] Telemetry: Optimize Event Serialization", "body": "Benchmark and optimize JSON serialization in 09_telemetry/pipelines for 200k events/sec.", "label": "enhancement,needs-triage"}, + {"title": "[DOCS] Theory: Document Game-Theoretic Policy Stability", "body": "Create formal documentation for action debt and cooldown timers in the Game Theory layer.", "label": "enhancement,needs-triage"}, + {"title": "[INTEGRATION] Arbiter: Reputation-Weighted Quorum Implementation", "body": "Integrate reputation scores from P2P nodes into the Byzantine-Resistant consensus mechanism.", "label": "enhancement,needs-triage"}, + {"title": "[TOOLS] Reverse Engineering: YARA Rule Automation", "body": "Automate YARA rule deployment to the security distribution layer (07_security/yara).", "label": "enhancement,needs-triage"}, + {"title": "[L2] Kernel Scheduler: Prototype Game-Aware Scheduling", "body": "Prototype a kernel-level scheduler policy that prioritizes processes based on Arbiter importance scores.", "label": "enhancement,needs-triage"}, + {"title": "[L3] Physics: Validate Thermal Inertia Smoothing", "body": "Verify the 0.7 thermal inertia smoothing constant against highly volatile attack workloads (R024).", "label": "enhancement,needs-triage"}, + {"title": "[L3] Telemetry: Implement Wavelet-based Noise Reduction", "body": "Implement wavelet transform filters in 09_telemetry/math_filters for telemetry pre-processing.", "label": "enhancement,needs-triage"}, + {"title": "[L6] Forensics: Implement Automated Hash Chain Auditing", "body": "Create automated audit tool that validates the hash-chain integrity of all Forensic snapshots in 08_forensics.", "label": "enhancement,needs-triage"}, + {"title": "[INTEGRATION] Infrastructure: Formalize Observability Pipeline", "body": "Formalize the pipeline between 12_infrastructure/observability and 09_telemetry/telemetry_agent.", "label": "enhancement,needs-triage"}, + {"title": "[L0] Foundations: Implement Bit Manipulation Lab", "body": "Implement Lab 00 (Number systems and bit operations) from 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md.", "label": "enhancement,needs-triage"} +] + +for issue in issues: + body_content = issue["body"] + "\n\n> *This was generated by AI during triage.*" + cmd = [ + "gh", "issue", "create", + "--title", issue["title"], + "--body", body_content, + "--label", issue["label"] + ] + try: + subprocess.run(cmd, check=True) + print(f"Created: {issue['title']}") + time.sleep(1) + except Exception as e: + print(f"Failed: {issue['title']} - {e}") diff --git a/tools/guard_runtime_py/cli.py b/tools/guard_runtime_py/cli.py index 1c9f7a2b6..fbc425ea1 100644 --- a/tools/guard_runtime_py/cli.py +++ b/tools/guard_runtime_py/cli.py @@ -1,5 +1,6 @@ """Simple CLI for prototype guard runtime.""" import argparse +import os from guard_runtime.daemon import GuardDaemon import json import socket From ce8dbec433124672275537133f34e5026d6d4ca9 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 19:01:04 +0530 Subject: [PATCH 3/7] chore: Update go.work for suspicion counter module --- go.work | 1 + 1 file changed, 1 insertion(+) diff --git a/go.work b/go.work index 0231dcb73..395cccf09 100644 --- a/go.work +++ b/go.work @@ -9,6 +9,7 @@ use ( ./14_experiments/telemetry_replay ./agents ./custom/control_plane + ./phoenix_os/agents/internal/security ./phoenix_os/arbiter ./phoenix_os/bus ./phoenix_os/common From e734f136ec6e3932ebcea227229bf4a5d43bdfb7 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 19:13:35 +0530 Subject: [PATCH 4/7] chore: Track go.mod for security agents --- phoenix_os/agents/internal/security/go.mod | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 phoenix_os/agents/internal/security/go.mod diff --git a/phoenix_os/agents/internal/security/go.mod b/phoenix_os/agents/internal/security/go.mod new file mode 100644 index 000000000..cb1d3dc6c --- /dev/null +++ b/phoenix_os/agents/internal/security/go.mod @@ -0,0 +1,5 @@ +module phoenix/agents/internal/security + +go 1.25.0 + +replace phoenix/security => ../../../07_security From c278297128f4a350f966dbe81a070147247a59d6 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 19:20:39 +0530 Subject: [PATCH 5/7] ci: Fix go build command --- .github/workflows/lint_build_docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint_build_docs.yml b/.github/workflows/lint_build_docs.yml index c8100ec1a..29fd57f0c 100644 --- a/.github/workflows/lint_build_docs.yml +++ b/.github/workflows/lint_build_docs.yml @@ -48,7 +48,7 @@ jobs: run: | if [ -f go.work ]; then echo "Building with go.work..." - go build ./... + go build all else echo "Building individual modules..." modules=( From b0ed88e84dc55aa0ada44f776e540c974d35edff Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 19:44:36 +0530 Subject: [PATCH 6/7] feat: Implement Kalman-Based Drift Detection in PhysicsAgent [Issue #706] --- agents/internal/physics/kalman.go | 36 ++++++++++++++++++++++++++++++ agents/internal/physics/physics.go | 8 ++++--- 2 files changed, 41 insertions(+), 3 deletions(-) create mode 100644 agents/internal/physics/kalman.go diff --git a/agents/internal/physics/kalman.go b/agents/internal/physics/kalman.go new file mode 100644 index 000000000..59c576416 --- /dev/null +++ b/agents/internal/physics/kalman.go @@ -0,0 +1,36 @@ +package physics + +// KalmanFilter implements a simple 1D Kalman filter for anomaly detection +type KalmanFilter struct { + Q float64 // process noise covariance + R float64 // measurement noise covariance + P float64 // estimation error covariance + X float64 // value + K float64 // kalman gain +} + +func NewKalmanFilter(q, r, p, initialValue float64) *KalmanFilter { + return &KalmanFilter{ + Q: q, + R: r, + P: p, + X: initialValue, + } +} + +func (kf *KalmanFilter) Update(measurement float64) float64 { + // Prediction update + // X = X + // P = P + Q + kf.P = kf.P + kf.Q + + // Measurement update + // K = P / (P + R) + kf.K = kf.P / (kf.P + kf.R) + // X = X + K * (measurement - X) + kf.X = kf.X + kf.K*(measurement-kf.X) + // P = (1 - K) * P + kf.P = (1 - kf.K) * kf.P + + return kf.X +} diff --git a/agents/internal/physics/physics.go b/agents/internal/physics/physics.go index d0dac3d30..b26680619 100644 --- a/agents/internal/physics/physics.go +++ b/agents/internal/physics/physics.go @@ -19,11 +19,13 @@ type Agent struct { lastEntropy float64 lastSDI float64 threatTemp float64 + tempFilter *KalmanFilter } func NewPhysicsAgent() *Agent { return &Agent{ threatTemp: 0.1, // baseline normal temp + tempFilter: NewKalmanFilter(0.1, 1.0, 1.0, 0.1), } } @@ -87,11 +89,11 @@ func (a *Agent) GetSecurityState(graph *types.IncidentGraph, now time.Time) (typ if targetTemp > 10.0 { targetTemp = 10.0 } - // Simple thermal inertia (smoothing) - a.threatTemp = a.threatTemp*0.7 + targetTemp*0.3 + + // Apply Kalman filter to smooth and predict threat temperature + a.threatTemp = a.tempFilter.Update(targetTemp) // Retrieve Shannon entropy from monitor package - // We'll compute it from mock bytes for this state check or use a default testData := make([]byte, 256) if maxThreat >= 7.0 { // High disorder data From b696914779ddc09af5e1574dfd99ce49f94cda60 Mon Sep 17 00:00:00 2001 From: fallofpheonix Date: Thu, 21 May 2026 19:44:41 +0530 Subject: [PATCH 7/7] ci: Enable git lfs in telemetry gate checkout --- .github/workflows/telemetry_gate.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/telemetry_gate.yml b/.github/workflows/telemetry_gate.yml index ea582ccc7..f07f7c2ac 100644 --- a/.github/workflows/telemetry_gate.yml +++ b/.github/workflows/telemetry_gate.yml @@ -11,6 +11,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + lfs: true - name: Set up Go uses: actions/setup-go@v4