[P3] feat(marl): Implement MARL Stability

PHOENIX_SOLUTIONS.md

@@ -1,6 +1,65 @@
-# PhoenixOS: Expert-Aligned Solutions
+# PhoenixOS Architectural Solutions
 
-This document defines the refined architectural bridges for the PhoenixOS Matrix.
+## High-Level Architecture (The 7-Layer Stack)
+
+```text
++--------------------------------------------------------------+
+|                     USER / SOC INTERFACE                      |
+| Dashboards | CLI | APIs | Alerts | Policy Studio | Replay UI |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                    AI REASONING LAYER                         |
+| Evidence Engine | Explainability | Risk Models | Agents       |
+| LLM Runtime | Confidence Scoring | Recommendation Engine      |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                  CONTROL + DECISION LAYER                     |
+| State Machine: SAFE -> WATCH -> SUSPICIOUS -> CRITICAL        |
+| PID Controller | Policy Engine | Containment Manager          |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                 GAME THEORY / STRATEGY LAYER                  |
+| Stackelberg Defense | Bayesian Inference                      |
+| ESS Models | Resource Games | Security Economics             |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                   PHYSICS SECURITY LAYER                      |
+| Security Entropy | Disorder Index | Energy State             |
+| SIR Propagation | Kalman Estimation | Dynamics Engine         |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                 GRAPH + CORRELATION LAYER                     |
+| Process DAG | File Graph | Socket Graph | Identity Graph      |
+| PageRank | Betweenness | Lineage Engine | Risk Ranking        |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|               MATHEMATICAL ANALYTICS LAYER                    |
+| Shannon Entropy | KL Divergence | FFT | Queue Theory          |
+| Statistical Models | Detection Metrics                        |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                  TELEMETRY COLLECTION LAYER                   |
+| eBPF Probes | Ring Buffers | Event Bus | Normalization        |
+| Proc Metadata | Syscalls | File Ops | Network Events          |
++---------------------------▲----------------------------------+
+                            |
++--------------------------------------------------------------+
+|                KERNEL + HARDWARE FOUNDATION                   |
+| Linux Kernel | Drivers | CPU | Memory | Storage | Network     |
++--------------------------------------------------------------+
+```
+
+## Core Philosophy
+We replace threshold-based security with mathematically grounded models. A traditional OS triggers alerts based on static limits; SentinelOS triggers actions based on provable deviations (e.g., KL divergence exceeding bit-thresholds) and formally analyzed game-theoretic equilibrium.
+
+---
 
 ## 1. Finite-State Control (L6 -> L5)
 **Solution:** Replace linear/exponential gain with a **State-Aware Controller**.

go.work

@@ -9,7 +9,18 @@ use (
 	./14_experiments/telemetry_replay
 	./agents
 	./custom/control_plane
+	./phoenix_os/agents/external/benchmark
+	./phoenix_os/agents/external/build
+	./phoenix_os/agents/external/common
+	./phoenix_os/agents/external/intel
+	./phoenix_os/agents/external/research
+	./phoenix_os/agents/internal/common
+	./phoenix_os/agents/internal/game/marl
+	./phoenix_os/agents/internal/healer
+	./phoenix_os/agents/internal/optimizer
 	./phoenix_os/agents/internal/security
+	./phoenix_os/agents/internal/swarm
+	./phoenix_os/agents/internal/swarm/governance
 	./phoenix_os/arbiter
 	./phoenix_os/bus
 	./phoenix_os/common

phoenix_os/agents/internal/game/marl/go.mod

@@ -0,0 +1,3 @@
+module phoenix/agents/game/marl
+
+go 1.25.0

phoenix_os/agents/internal/game/marl/stability.go

@@ -17,8 +17,12 @@ type StabilityController struct {
 }
 
 // NewStabilityController initializes a controller with defined limits and decay rate.
+<<<<<<< HEAD
+func NewStabilityController(cooldown time.Duration, maxContainment float64, decayRate float64, now time.Time) *StabilityController {
+=======
 func NewStabilityController(cooldown time.Duration, maxContainment float64, decayRate float64) *StabilityController {
 	now := time.Now()
+>>>>>>> origin/main
 	return &StabilityController{
 		cooldown:       cooldown,
 		maxContainment: maxContainment,

phoenix_os/agents/internal/game/marl/stability_test.go

@@ -6,10 +6,16 @@ import (
 )
 
 func TestStability(t *testing.T) {
+<<<<<<< HEAD
+	start := time.Now()
+	// 100ms cooldown, 1.0 max containment, decay 0.0 per sec (for testing strict limits)
+	sc := NewStabilityController(100*time.Millisecond, 1.0, 0.0, start)
+=======
 	// 100ms cooldown, 1.0 max containment, decay 0.0 per sec (for testing strict limits)
 	sc := NewStabilityController(100*time.Millisecond, 1.0, 0.0)
 
 	start := time.Now()
+>>>>>>> origin/main
 
 	// First action should pass
 	if !sc.TryRecordAction(0.5, start) {
@@ -36,16 +42,28 @@ func TestStability(t *testing.T) {
 }
 
 func TestStabilityDecay(t *testing.T) {
+<<<<<<< HEAD
+	start := time.Now()
+	// Decay 1.0 per second
+	sc := NewStabilityController(100*time.Millisecond, 1.0, 1.0, start)
+
+=======
 	// Decay 1.0 per second
 	sc := NewStabilityController(100*time.Millisecond, 1.0, 1.0)
 
 	start := time.Now()
+>>>>>>> origin/main
 
 	// Max out containment
 	sc.TryRecordAction(1.0, start)
 
+<<<<<<< HEAD
+	// Should fail (debt decays by 0.15 to 0.85, adding 0.2 makes it 1.05 > 1.0)
+	if sc.TryRecordAction(0.2, start.Add(150*time.Millisecond)) {
+=======
 	// Should fail
 	if sc.TryRecordAction(0.1, start.Add(150*time.Millisecond)) {
+>>>>>>> origin/main
 		t.Error("Expected action to be throttled due to containment limit")
 	}