[P2] feat(security): Implement Suspicion Counter

.github/workflows/lint_build_docs.yml

@@ -48,7 +48,7 @@ jobs:
         run: |
           if [ -f go.work ]; then
             echo "Building with go.work..."
-            go build ./...
+            go build all
           else
             echo "Building individual modules..."
             modules=(

.github/workflows/telemetry_gate.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          lfs: true
 
       - name: Set up Go
         uses: actions/setup-go@v4

agents/internal/physics/kalman.go

@@ -0,0 +1,36 @@
+package physics
+
+// KalmanFilter implements a simple 1D Kalman filter for anomaly detection
+type KalmanFilter struct {
+	Q float64 // process noise covariance
+	R float64 // measurement noise covariance
+	P float64 // estimation error covariance
+	X float64 // value
+	K float64 // kalman gain
+}
+
+func NewKalmanFilter(q, r, p, initialValue float64) *KalmanFilter {
+	return &KalmanFilter{
+		Q: q,
+		R: r,
+		P: p,
+		X: initialValue,
+	}
+}
+
+func (kf *KalmanFilter) Update(measurement float64) float64 {
+	// Prediction update
+	// X = X
+	// P = P + Q
+	kf.P = kf.P + kf.Q
+
+	// Measurement update
+	// K = P / (P + R)
+	kf.K = kf.P / (kf.P + kf.R)
+	// X = X + K * (measurement - X)
+	kf.X = kf.X + kf.K*(measurement-kf.X)
+	// P = (1 - K) * P
+	kf.P = (1 - kf.K) * kf.P
+
+	return kf.X
+}

agents/internal/physics/physics.go

@@ -19,11 +19,13 @@ type Agent struct {
 	lastEntropy  float64
 	lastSDI      float64
 	threatTemp   float64
+	tempFilter   *KalmanFilter
 }
 
 func NewPhysicsAgent() *Agent {
 	return &Agent{
 		threatTemp: 0.1, // baseline normal temp
+		tempFilter: NewKalmanFilter(0.1, 1.0, 1.0, 0.1),
 	}
 }
 
@@ -87,11 +89,11 @@ func (a *Agent) GetSecurityState(graph *types.IncidentGraph, now time.Time) (typ
 	if targetTemp > 10.0 {
 		targetTemp = 10.0
 	}
-	// Simple thermal inertia (smoothing)
-	a.threatTemp = a.threatTemp*0.7 + targetTemp*0.3
+
+	// Apply Kalman filter to smooth and predict threat temperature
+	a.threatTemp = a.tempFilter.Update(targetTemp)
 
 	// Retrieve Shannon entropy from monitor package
-	// We'll compute it from mock bytes for this state check or use a default
 	testData := make([]byte, 256)
 	if maxThreat >= 7.0 {
 		// High disorder data

go.work

@@ -9,6 +9,7 @@ use (
 	./14_experiments/telemetry_replay
 	./agents
 	./custom/control_plane
+	./phoenix_os/agents/internal/security
 	./phoenix_os/arbiter
 	./phoenix_os/bus
 	./phoenix_os/common

phoenix_os/agents/internal/security/go.mod

@@ -0,0 +1,5 @@
+module phoenix/agents/internal/security
+
+go 1.25.0
+
+replace phoenix/security => ../../../07_security

phoenix_os/agents/internal/security/reputation.go

@@ -0,0 +1,30 @@
+package security
+
+import "sync"
+
+// ReputationManager tracks the trustworthiness of nodes in the swarm.
+type ReputationManager struct {
+	mu         sync.RWMutex
+	Reputation map[string]float64
+}
+
+// NewReputationManager initializes with default scores.
+func NewReputationManager() *ReputationManager {
+	return &ReputationManager{
+		Reputation: make(map[string]float64),
+	}
+}
+
+// Deduct reduces a node's reputation score for suspicious behavior.
+func (rm *ReputationManager) Deduct(nodeID string, amount float64) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+	rm.Reputation[nodeID] -= amount
+}
+
+// GetScore returns the current reputation of a node.
+func (rm *ReputationManager) GetScore(nodeID string) float64 {
+	rm.mu.RLock()
+	defer rm.mu.RUnlock()
+	return rm.Reputation[nodeID]
+}

phoenix_os/agents/internal/security/reputation_test.go

@@ -0,0 +1,14 @@
+package security
+
+import "testing"
+
+func TestReputationDeduction(t *testing.T) {
+	rm := NewReputationManager()
+	rm.Reputation["node-1"] = 1.0
+
+	rm.Deduct("node-1", 0.2)
+	score := rm.GetScore("node-1")
+	if score != 0.8 {
+		t.Errorf("Expected 0.8, got %f", score)
+	}
+}

tools/create_adhoc_issues.py

@@ -0,0 +1,34 @@
+import subprocess
+import time
+
+issues = [
+    ("[LABS] [L0] Implement Foundations Labs", "Implement labs 00-08 defined in 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md.\n\nTasks:\n- Lab 00: Number systems\n- Lab 01: Memory model\n- Lab 02: Sequential data structures\n- Lab 08: Problem-solving", "enhancement,needs-triage"),
+    ("[LABS] [L0] Implement Architecture Labs", "Implement labs defined in 01_research/stage_00_foundations/labs/phase_01_architecture_labs.md.\n\nTasks:\n- Assembly calling convention\n- Cache locality benchmark\n- False sharing analysis", "enhancement,needs-triage"),
+    ("[LABS] [L0] Implement Programming Labs", "Implement labs defined in 01_research/stage_00_foundations/labs/phase_02_low_level_programming_labs.md.\n\nTasks:\n- Heap allocator\n- ELF parser\n- Mini shell", "enhancement,needs-triage"),
+    ("[LABS] [L1] Implement OS Internals Labs", "Implement labs defined in 01_research/stage_01_system_internals/labs/phase_03_operating_systems_labs.md.\n\nTasks:\n- Process lifecycle\n- Scheduler\n- VFS", "enhancement,needs-triage"),
+    ("[LABS] [L2] Implement Linux Internals Labs", "Implement labs defined in 01_research/stage_02_linux_and_distros/labs/phase_04_linux_internals_labs.md.\n\nTasks:\n- Kernel build\n- Kernel module\n- Namespaces/cgroups", "enhancement,needs-triage"),
+    ("[LABS] [L3] Implement Networking Labs", "Implement labs defined in 01_research/stage_03_networking/labs/phase_05_networking_labs.md.\n\nTasks:\n- OSI/Encapsulation\n- DNS\n- TCP\n- Packet dissection", "enhancement,needs-triage"),
+    ("[SURFACE] Refactor Orchestrator State Handling", "The file agents/surface/orchestrator/service.py contains TODOs related to label management ('surface:todo').\n\nTasks:\n- Refactor state-to-label mapping.\n- Replace hardcoded TODO labels.", "bug,needs-triage"),
+    ("[L0] Foundations: Establish Problem-solving Lab Set", "Per 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md, the Problem-solving lab (Lab 08) needs definition.\n\nTasks:\n- Define the lab requirements for the problem-solving set.", "research,needs-triage"),
+    ("[L1] Architecture: Document NUMA Topology Reasoning", "Document topology and locality rationale for PhoenixOS (01_research/stage_00_foundations/labs/phase_01_architecture_labs.md).", "documentation,needs-triage"),
+    ("[L1] Low-Level Programming: Formalize Rust Syscall Wrapper", "Design safe syscall abstraction layer for Rust (01_research/stage_00_foundations/labs/phase_02_low_level_programming_labs.md).", "enhancement,needs-triage"),
+    ("[L2] OS Internals: Modify xv6 for PhoenixOS", "Plan modifications for syscalls, scheduler, and file operations in xv6 (01_research/stage_01_system_internals/labs/phase_03_operating_systems_labs.md).", "research,needs-triage"),
+    ("[L3] Networking: Implement Packet Dissection Parser", "Implement hex parsing for raw packets (01_research/stage_03_networking/labs/phase_05_networking_labs.md).", "enhancement,needs-triage"),
+    ("[SURFACE] Orchestrator: Update Label Management", "Update labels from 'surface:todo' to canonical triage labels in agents/surface/orchestrator/service.py.", "bug,needs-triage"),
+    ("[LABS] [L2] cgroups: Investigate v1 vs v2 differences", "Analyze differences between cgroup v1 and v2 (01_research/stage_02_linux_and_distros/labs/phase_04_linux_internals_labs.md).", "research,needs-triage"),
+    ("[LABS] [L3] Networking: Security Analysis of DNS Exfiltration", "Perform security analysis on plaintext DNS vs. DoH (01_research/stage_03_networking/labs/phase_05_networking_labs.md).", "security,needs-triage")
+]
+
+for title, body, label in issues:
+    cmd = [
+        "gh", "issue", "create",
+        "--title", title,
+        "--body", body + "\n\n> *This was generated by AI during triage.*",
+        "--label", label
+    ]
+    try:
+        subprocess.run(cmd, check=True)
+        print(f"Created: {title}")
+        time.sleep(1)
+    except Exception as e:
+        print(f"Failed: {title} - {e}")

tools/create_final_issues.py

@@ -0,0 +1,35 @@
+import subprocess
+import time
+
+issues = [
+    {"title": "[RESEARCH] [L6] Dynamics: State-Space Trajectory Drift", "body": "Investigate embedding state-space analysis in 06_ai/dynamics to detect trajectory drift (R025).", "label": "enhancement,needs-triage"},
+    {"title": "[INTELLIGENCE] [L5.5] Arbiter: VCG Mechanism Design", "body": "Design and implement VCG mechanisms for game-theoretic resource allocation (R030).", "label": "enhancement,needs-triage"},
+    {"title": "[INTELLIGENCE] [L5.5] Arbiter: Strong Stackelberg Equilibrium", "body": "Implement efficient SSE calculation for defender/attacker game dynamics (R028).", "label": "enhancement,needs-triage"},
+    {"title": "[TESTING] GraphAgent: Validate DAG Scaling Limit", "body": "Stress test 09_telemetry/process_graphs with >100k nodes to validate 3-tier storage performance.", "label": "enhancement,needs-triage"},
+    {"title": "[L1] Guard Runtime: eBPF Syscall Filtering Enhancement", "body": "Enhance eBPF filters in 10_kernel/guard to detect complex multi-syscall attack patterns.", "label": "enhancement,needs-triage"},
+    {"title": "[L3] Telemetry: Optimize Event Serialization", "body": "Benchmark and optimize JSON serialization in 09_telemetry/pipelines for 200k events/sec.", "label": "enhancement,needs-triage"},
+    {"title": "[DOCS] Theory: Document Game-Theoretic Policy Stability", "body": "Create formal documentation for action debt and cooldown timers in the Game Theory layer.", "label": "enhancement,needs-triage"},
+    {"title": "[INTEGRATION] Arbiter: Reputation-Weighted Quorum Implementation", "body": "Integrate reputation scores from P2P nodes into the Byzantine-Resistant consensus mechanism.", "label": "enhancement,needs-triage"},
+    {"title": "[TOOLS] Reverse Engineering: YARA Rule Automation", "body": "Automate YARA rule deployment to the security distribution layer (07_security/yara).", "label": "enhancement,needs-triage"},
+    {"title": "[L2] Kernel Scheduler: Prototype Game-Aware Scheduling", "body": "Prototype a kernel-level scheduler policy that prioritizes processes based on Arbiter importance scores.", "label": "enhancement,needs-triage"},
+    {"title": "[L3] Physics: Validate Thermal Inertia Smoothing", "body": "Verify the 0.7 thermal inertia smoothing constant against highly volatile attack workloads (R024).", "label": "enhancement,needs-triage"},
+    {"title": "[L3] Telemetry: Implement Wavelet-based Noise Reduction", "body": "Implement wavelet transform filters in 09_telemetry/math_filters for telemetry pre-processing.", "label": "enhancement,needs-triage"},
+    {"title": "[L6] Forensics: Implement Automated Hash Chain Auditing", "body": "Create automated audit tool that validates the hash-chain integrity of all Forensic snapshots in 08_forensics.", "label": "enhancement,needs-triage"},
+    {"title": "[INTEGRATION] Infrastructure: Formalize Observability Pipeline", "body": "Formalize the pipeline between 12_infrastructure/observability and 09_telemetry/telemetry_agent.", "label": "enhancement,needs-triage"},
+    {"title": "[L0] Foundations: Implement Bit Manipulation Lab", "body": "Implement Lab 00 (Number systems and bit operations) from 01_research/stage_00_foundations/labs/phase_00_implementation_labs.md.", "label": "enhancement,needs-triage"}
+]
+
+for issue in issues:
+    body_content = issue["body"] + "\n\n> *This was generated by AI during triage.*"
+    cmd = [
+        "gh", "issue", "create",
+        "--title", issue["title"],
+        "--body", body_content,
+        "--label", issue["label"]
+    ]
+    try:
+        subprocess.run(cmd, check=True)
+        print(f"Created: {issue['title']}")
+        time.sleep(1)
+    except Exception as e:
+        print(f"Failed: {issue['title']} - {e}")

tools/guard_runtime_py/cli.py

@@ -1,5 +1,6 @@
 """Simple CLI for prototype guard runtime."""
 import argparse
+import os
 from guard_runtime.daemon import GuardDaemon
 import json
 import socket