self-review 2026-07-19: close silent sync-starvation hole + heartbeat deltas

- engram refresh URL now resolves env -> state -> localhost:8742, same
  hardening ise_post got after the boot-4 blackout. Previously a corrupted/
  empty soul_engram_url state key silently disabled sync forever while
  heartbeats kept flowing — WM starves of Knowledge nodes with no outward
  sign.
- heartbeat ISE: node_delta, edge_delta (growth vs stall vs flood is now
  one field, not cross-ISE forensics), sync_age_ms from a new
  soul.last_sync_ok_ts stamp (-1 = never; >> SOUL_REFRESH_MS = refresh
  path broken). Verified live: pulse 1 sync_age_ms=-1, sync fired +1.6s,
  age counts up between syncs.
This commit is contained in:
2026-07-19 08:47:00 -05:00
parent 1011d8e5be
commit 50cf67bd66
4 changed files with 272 additions and 131 deletions
Generated Vendored
+111 -77
View File
@@ -66,17 +66,21 @@ el_val_t idle_reset(void) {
el_val_t ise_post(el_val_t content) {
el_val_t ise_url = env(EL_STR("SOUL_ISE_URL"));
el_val_t engram_url = ({ el_val_t _if_result_1 = 0; if (str_eq(ise_url, EL_STR(""))) { _if_result_1 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_1 = (ise_url); } _if_result_1; });
if (str_eq(engram_url, EL_STR(""))) {
el_val_t discard = engram_node_full(content, EL_STR("InternalStateEvent"), EL_STR("state-event"), el_from_float(0.3), el_from_float(0.3), el_from_float(0.8), EL_STR("Episodic"), EL_STR("[\"internal-state\",\"InternalStateEvent\"]"));
return EL_STR("");
}
el_val_t state_url = ({ el_val_t _if_result_1 = 0; if (str_eq(ise_url, EL_STR(""))) { _if_result_1 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_1 = (ise_url); } _if_result_1; });
el_val_t engram_url = ({ el_val_t _if_result_2 = 0; if (str_eq(state_url, EL_STR(""))) { _if_result_2 = (EL_STR("http://localhost:8742")); } else { _if_result_2 = (state_url); } _if_result_2; });
el_val_t safe1 = str_replace(content, EL_STR("\\"), EL_STR("\\\\"));
el_val_t safe2 = str_replace(safe1, EL_STR("\""), EL_STR("\\\""));
el_val_t safe3 = str_replace(safe2, EL_STR("\n"), EL_STR("\\n"));
el_val_t safe4 = str_replace(safe3, EL_STR("\r"), EL_STR("\\r"));
el_val_t body = el_str_concat(el_str_concat(EL_STR("{\"content\":\""), safe4), EL_STR("\"}"));
el_val_t discard = http_post_json(el_str_concat(engram_url, EL_STR("/api/neuron/state-events")), body);
el_val_t resp = http_post_json(el_str_concat(engram_url, EL_STR("/api/neuron/state-events")), body);
if (str_eq(resp, EL_STR(""))) {
el_val_t fail_raw = state_get(EL_STR("soul.ise_fail_count"));
el_val_t fail_n = ({ el_val_t _if_result_3 = 0; if (str_eq(fail_raw, EL_STR(""))) { _if_result_3 = (0); } else { _if_result_3 = (str_to_int(fail_raw)); } _if_result_3; });
state_set(EL_STR("soul.ise_fail_count"), int_to_str((fail_n + 1)));
el_val_t discard = engram_node_full(content, EL_STR("InternalStateEvent"), EL_STR("state-event"), el_from_float(0.3), el_from_float(0.3), el_from_float(0.8), EL_STR("Episodic"), EL_STR("[\"internal-state\",\"InternalStateEvent\",\"ise-fallback-local\"]"));
return EL_STR("");
}
return EL_STR("");
return 0;
}
@@ -125,7 +129,7 @@ el_val_t embed_ok(void) {
el_val_t emit_heartbeat(void) {
el_val_t pulse = int_to_str(pulse_count());
el_val_t boot_raw = state_get(EL_STR("soul_boot_count"));
el_val_t boot = ({ el_val_t _if_result_2 = 0; if (str_eq(boot_raw, EL_STR(""))) { _if_result_2 = (EL_STR("0")); } else { _if_result_2 = (boot_raw); } _if_result_2; });
el_val_t boot = ({ el_val_t _if_result_4 = 0; if (str_eq(boot_raw, EL_STR(""))) { _if_result_4 = (EL_STR("0")); } else { _if_result_4 = (boot_raw); } _if_result_4; });
el_val_t idle = int_to_str(idle_count());
el_val_t ts = time_now();
el_val_t nc = engram_node_count();
@@ -137,7 +141,25 @@ el_val_t emit_heartbeat(void) {
el_val_t up_ms = elapsed_ms();
el_val_t up_human = elapsed_human();
el_val_t emb_ok = embed_ok();
el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR("}"));
el_val_t fail_raw = state_get(EL_STR("soul.ise_fail_count"));
el_val_t fail_str = ({ el_val_t _if_result_5 = 0; if (str_eq(fail_raw, EL_STR(""))) { _if_result_5 = (EL_STR("0")); } else { _if_result_5 = (fail_raw); } _if_result_5; });
el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
el_val_t sat_str = ({ el_val_t _if_result_6 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_6 = (EL_STR("0")); } else { _if_result_6 = (sat_raw); } _if_result_6; });
el_val_t prev_wm_raw = state_get(EL_STR("soul.prev_wm_active"));
el_val_t prev_wm = ({ el_val_t _if_result_7 = 0; if (str_eq(prev_wm_raw, EL_STR(""))) { _if_result_7 = (0); } else { _if_result_7 = (str_to_int(prev_wm_raw)); } _if_result_7; });
el_val_t wm_delta = (wmc - prev_wm);
state_set(EL_STR("soul.prev_wm_active"), int_to_str(wmc));
el_val_t prev_nc_raw = state_get(EL_STR("soul.prev_node_count"));
el_val_t prev_nc = ({ el_val_t _if_result_8 = 0; if (str_eq(prev_nc_raw, EL_STR(""))) { _if_result_8 = (nc); } else { _if_result_8 = (str_to_int(prev_nc_raw)); } _if_result_8; });
el_val_t node_delta = (nc - prev_nc);
state_set(EL_STR("soul.prev_node_count"), int_to_str(nc));
el_val_t prev_ec_raw = state_get(EL_STR("soul.prev_edge_count"));
el_val_t prev_ec = ({ el_val_t _if_result_9 = 0; if (str_eq(prev_ec_raw, EL_STR(""))) { _if_result_9 = (ec); } else { _if_result_9 = (str_to_int(prev_ec_raw)); } _if_result_9; });
el_val_t edge_delta = (ec - prev_ec);
state_set(EL_STR("soul.prev_edge_count"), int_to_str(ec));
el_val_t sync_ok_raw = state_get(EL_STR("soul.last_sync_ok_ts"));
el_val_t sync_age = ({ el_val_t _if_result_10 = 0; if (str_eq(sync_ok_raw, EL_STR(""))) { _if_result_10 = ((0 - 1)); } else { _if_result_10 = ((ts - str_to_int(sync_ok_raw))); } _if_result_10; });
el_val_t payload = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"heartbeat\",\"pulse\":"), pulse), EL_STR(",\"tick\":")), pulse), EL_STR(",\"boot\":")), boot), EL_STR(",\"idle\":")), idle), EL_STR(",\"node_count\":")), int_to_str(nc)), EL_STR(",\"edge_count\":")), int_to_str(ec)), EL_STR(",\"node_delta\":")), int_to_str(node_delta)), EL_STR(",\"edge_delta\":")), int_to_str(edge_delta)), EL_STR(",\"wm_active\":")), int_to_str(wmc)), EL_STR(",\"wm_delta\":")), int_to_str(wm_delta)), EL_STR(",\"sync_added_total\":")), sat_str), EL_STR(",\"sync_age_ms\":")), int_to_str(sync_age)), EL_STR(",\"wm_avg_weight\":")), wm_avg_str), EL_STR(",\"wm_top\":")), wm_top), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR(",\"uptime_ms\":")), int_to_str(up_ms)), EL_STR(",\"uptime\":\"")), up_human), EL_STR("\",\"embed_ok\":")), int_to_str(emb_ok)), EL_STR(",\"ise_fail\":")), fail_str), EL_STR("}"));
ise_post(payload);
return 0;
}
@@ -194,13 +216,13 @@ el_val_t proactive_curiosity(void) {
el_val_t curiosity_term_b = state_get(EL_STR("cseed_b"));
el_val_t curiosity_term_c = state_get(EL_STR("cseed_c"));
el_val_t curiosity_seed = el_str_concat(el_str_concat(el_str_concat(el_str_concat(curiosity_term_a, EL_STR(" ")), curiosity_term_b), EL_STR(" ")), curiosity_term_c);
el_val_t results_a = engram_activate_json(curiosity_term_a, 1);
el_val_t results_b = engram_activate_json(curiosity_term_b, 1);
el_val_t results_c = engram_activate_json(curiosity_term_c, 1);
el_val_t found_a = json_array_len(results_a);
el_val_t found_b = json_array_len(results_b);
el_val_t found_c = json_array_len(results_c);
el_val_t found = ((found_a + found_b) + found_c);
el_val_t results_all = engram_activate_json(curiosity_seed, 1);
el_val_t found = json_array_len(results_all);
el_val_t top_entry = json_array_get(results_all, 0);
el_val_t top_id = json_get(top_entry, EL_STR("id"));
if (!str_eq(top_id, EL_STR(""))) {
engram_strengthen(top_id);
}
state_set(EL_STR("cseed_auto"), EL_STR(""));
el_val_t wm10 = engram_wm_top_json(10);
el_val_t wm10_n9 = json_array_get(wm10, 9);
@@ -224,7 +246,7 @@ el_val_t proactive_curiosity(void) {
auto_term_try_slot(json_get(wm10_n1, EL_STR("node_type")), json_get(wm10_n1, EL_STR("label")));
auto_term_try_slot(json_get(wm10_n0, EL_STR("node_type")), json_get(wm10_n0, EL_STR("label")));
el_val_t auto_term = state_get(EL_STR("cseed_auto"));
el_val_t results_auto = ({ el_val_t _if_result_3 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_3 = (EL_STR("[]")); } else { _if_result_3 = (engram_activate_json(auto_term, 1)); } _if_result_3; });
el_val_t results_auto = ({ el_val_t _if_result_11 = 0; if (str_eq(auto_term, EL_STR(""))) { _if_result_11 = (EL_STR("[]")); } else { _if_result_11 = (engram_activate_json(auto_term, 1)); } _if_result_11; });
el_val_t found_auto = json_array_len(results_auto);
el_val_t total_found = (found + found_auto);
el_val_t safe_auto = str_replace(auto_term, EL_STR("\""), EL_STR("'"));
@@ -402,7 +424,6 @@ el_val_t one_cycle(void) {
}
el_val_t outcome = respond(action);
record(outcome);
pulse_inc();
return 1;
return 0;
}
@@ -414,9 +435,9 @@ el_val_t awareness_run(void) {
state_set(EL_STR("soul.boot_ts"), int_to_str(time_now()));
}
el_val_t tick_raw = env(EL_STR("SOUL_TICK_MS"));
el_val_t tick_ms = ({ el_val_t _if_result_4 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_4 = (200); } else { _if_result_4 = (str_to_int(tick_raw)); } _if_result_4; });
el_val_t tick_ms = ({ el_val_t _if_result_12 = 0; if (str_eq(tick_raw, EL_STR(""))) { _if_result_12 = (200); } else { _if_result_12 = (str_to_int(tick_raw)); } _if_result_12; });
el_val_t beat_ms_raw = env(EL_STR("SOUL_HEARTBEAT_MS"));
el_val_t beat_ms = ({ el_val_t _if_result_5 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_5 = (60000); } else { _if_result_5 = (str_to_int(beat_ms_raw)); } _if_result_5; });
el_val_t beat_ms = ({ el_val_t _if_result_13 = 0; if (str_eq(beat_ms_raw, EL_STR(""))) { _if_result_13 = (60000); } else { _if_result_13 = (str_to_int(beat_ms_raw)); } _if_result_13; });
el_val_t scan_ms = (beat_ms / 2);
while (1) {
el_val_t tick_mark = el_arena_push();
@@ -427,10 +448,16 @@ el_val_t awareness_run(void) {
return EL_STR("");
}
el_val_t did_work = one_cycle();
did_work = ({ el_val_t _if_result_6 = 0; if (did_work) { _if_result_6 = (idle_reset()); } else { _if_result_6 = (did_work); } _if_result_6; });
pulse_inc();
if (did_work) {
idle_reset();
}
if (!did_work) {
idle_inc();
}
el_val_t now_ts = time_now();
el_val_t last_beat_str = state_get(EL_STR("soul.last_beat_ts"));
el_val_t last_beat_ts = ({ el_val_t _if_result_7 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_7 = (0); } else { _if_result_7 = (str_to_int(last_beat_str)); } _if_result_7; });
el_val_t last_beat_ts = ({ el_val_t _if_result_14 = 0; if (str_eq(last_beat_str, EL_STR(""))) { _if_result_14 = (0); } else { _if_result_14 = (str_to_int(last_beat_str)); } _if_result_14; });
el_val_t beat_elapsed = (now_ts - last_beat_ts);
el_val_t should_beat = (beat_elapsed >= beat_ms);
if (should_beat) {
@@ -442,7 +469,7 @@ el_val_t awareness_run(void) {
}
}
el_val_t last_scan_str = state_get(EL_STR("soul.last_scan_ts"));
el_val_t last_scan_ts = ({ el_val_t _if_result_8 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_8 = (0); } else { _if_result_8 = (str_to_int(last_scan_str)); } _if_result_8; });
el_val_t last_scan_ts = ({ el_val_t _if_result_15 = 0; if (str_eq(last_scan_str, EL_STR(""))) { _if_result_15 = (0); } else { _if_result_15 = (str_to_int(last_scan_str)); } _if_result_15; });
el_val_t scan_elapsed = (now_ts - last_scan_ts);
el_val_t should_scan = (!did_work && (scan_elapsed >= scan_ms));
if (should_scan) {
@@ -450,13 +477,15 @@ el_val_t awareness_run(void) {
state_set(EL_STR("soul.last_scan_ts"), int_to_str(now_ts));
}
el_val_t refresh_ms_raw = env(EL_STR("SOUL_REFRESH_MS"));
el_val_t refresh_ms = ({ el_val_t _if_result_9 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_9 = (600000); } else { _if_result_9 = (str_to_int(refresh_ms_raw)); } _if_result_9; });
el_val_t refresh_ms = ({ el_val_t _if_result_16 = 0; if (str_eq(refresh_ms_raw, EL_STR(""))) { _if_result_16 = (600000); } else { _if_result_16 = (str_to_int(refresh_ms_raw)); } _if_result_16; });
el_val_t last_refresh_str = state_get(EL_STR("soul.last_refresh_ts"));
el_val_t last_refresh_ts = ({ el_val_t _if_result_10 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_10 = (0); } else { _if_result_10 = (str_to_int(last_refresh_str)); } _if_result_10; });
el_val_t last_refresh_ts = ({ el_val_t _if_result_17 = 0; if (str_eq(last_refresh_str, EL_STR(""))) { _if_result_17 = (0); } else { _if_result_17 = (str_to_int(last_refresh_str)); } _if_result_17; });
el_val_t refresh_elapsed = (now_ts - last_refresh_ts);
el_val_t should_refresh = (refresh_elapsed >= refresh_ms);
if (should_refresh) {
el_val_t engram_url = state_get(EL_STR("soul_engram_url"));
el_val_t sync_env_url = env(EL_STR("SOUL_ISE_URL"));
el_val_t sync_state_url = ({ el_val_t _if_result_18 = 0; if (str_eq(sync_env_url, EL_STR(""))) { _if_result_18 = (state_get(EL_STR("soul_engram_url"))); } else { _if_result_18 = (sync_env_url); } _if_result_18; });
el_val_t engram_url = ({ el_val_t _if_result_19 = 0; if (str_eq(sync_state_url, EL_STR(""))) { _if_result_19 = (EL_STR("http://localhost:8742")); } else { _if_result_19 = (sync_state_url); } _if_result_19; });
if (!str_eq(engram_url, EL_STR(""))) {
el_val_t sync_json = http_get(el_str_concat(engram_url, EL_STR("/api/sync")));
if (!str_eq(sync_json, EL_STR("")) && !str_eq(sync_json, EL_STR("{}"))) {
@@ -464,8 +493,13 @@ el_val_t awareness_run(void) {
el_val_t tmp = el_str_concat(el_str_concat(EL_STR("/tmp/soul-sync-"), cgi_id), EL_STR(".json"));
fs_write(tmp, sync_json);
el_val_t added = engram_load_merge(tmp);
el_val_t pruned_sync = engram_prune_telemetry(172800000);
el_val_t sat_raw = state_get(EL_STR("soul.sync_added_total"));
el_val_t sat_n = ({ el_val_t _if_result_20 = 0; if (str_eq(sat_raw, EL_STR(""))) { _if_result_20 = (0); } else { _if_result_20 = (str_to_int(sat_raw)); } _if_result_20; });
state_set(EL_STR("soul.sync_added_total"), int_to_str((sat_n + added)));
el_val_t ts2 = time_now();
ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"engram_sync\",\"added\":"), int_to_str(added)), EL_STR(",\"ts\":")), int_to_str(ts2)), EL_STR("}")));
state_set(EL_STR("soul.last_sync_ok_ts"), int_to_str(ts2));
ise_post(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"engram_sync\",\"added\":"), int_to_str(added)), EL_STR(",\"pruned\":")), int_to_str(pruned_sync)), EL_STR(",\"ts\":")), int_to_str(ts2)), EL_STR("}")));
}
}
state_set(EL_STR("soul.last_refresh_ts"), int_to_str(now_ts));
@@ -487,78 +521,78 @@ el_val_t security_research_authorized(void) {
}
el_val_t threat_score_command(el_val_t cmd) {
el_val_t s1 = ({ el_val_t _if_result_11 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_11 = (30); } else { _if_result_11 = (0); } _if_result_11; });
el_val_t s2 = ({ el_val_t _if_result_12 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_12 = (40); } else { _if_result_12 = (0); } _if_result_12; });
el_val_t s3 = ({ el_val_t _if_result_13 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_13 = (20); } else { _if_result_13 = (0); } _if_result_13; });
el_val_t s4 = ({ el_val_t _if_result_14 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_14 = (20); } else { _if_result_14 = (0); } _if_result_14; });
el_val_t s5 = ({ el_val_t _if_result_15 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_15 = (80); } else { _if_result_15 = (0); } _if_result_15; });
el_val_t s6 = ({ el_val_t _if_result_16 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_16 = (30); } else { _if_result_16 = (0); } _if_result_16; });
el_val_t s7 = ({ el_val_t _if_result_17 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_17 = (60); } else { _if_result_17 = (0); } _if_result_17; });
el_val_t s8 = ({ el_val_t _if_result_18 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_18 = (50); } else { _if_result_18 = (0); } _if_result_18; });
el_val_t s9 = ({ el_val_t _if_result_19 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_19 = (30); } else { _if_result_19 = (0); } _if_result_19; });
el_val_t s10 = ({ el_val_t _if_result_20 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_20 = (40); } else { _if_result_20 = (0); } _if_result_20; });
el_val_t s11 = ({ el_val_t _if_result_21 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_21 = (75); } else { _if_result_21 = (0); } _if_result_21; });
el_val_t s12 = ({ el_val_t _if_result_22 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_22 = (75); } else { _if_result_22 = (0); } _if_result_22; });
el_val_t s13 = ({ el_val_t _if_result_23 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_23 = (60); } else { _if_result_23 = (0); } _if_result_23; });
el_val_t s14 = ({ el_val_t _if_result_24 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_24 = (50); } else { _if_result_24 = (0); } _if_result_24; });
el_val_t s15 = ({ el_val_t _if_result_25 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_25 = (50); } else { _if_result_25 = (0); } _if_result_25; });
el_val_t s16 = ({ el_val_t _if_result_26 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_26 = (70); } else { _if_result_26 = (0); } _if_result_26; });
el_val_t s17 = ({ el_val_t _if_result_27 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_27 = (70); } else { _if_result_27 = (0); } _if_result_27; });
el_val_t s1 = ({ el_val_t _if_result_21 = 0; if (str_contains(cmd, EL_STR("nmap"))) { _if_result_21 = (30); } else { _if_result_21 = (0); } _if_result_21; });
el_val_t s2 = ({ el_val_t _if_result_22 = 0; if (str_contains(cmd, EL_STR("masscan"))) { _if_result_22 = (40); } else { _if_result_22 = (0); } _if_result_22; });
el_val_t s3 = ({ el_val_t _if_result_23 = 0; if (str_contains(cmd, EL_STR(" nc "))) { _if_result_23 = (20); } else { _if_result_23 = (0); } _if_result_23; });
el_val_t s4 = ({ el_val_t _if_result_24 = 0; if (str_contains(cmd, EL_STR("netcat"))) { _if_result_24 = (20); } else { _if_result_24 = (0); } _if_result_24; });
el_val_t s5 = ({ el_val_t _if_result_25 = 0; if (str_contains(cmd, EL_STR("/etc/shadow"))) { _if_result_25 = (80); } else { _if_result_25 = (0); } _if_result_25; });
el_val_t s6 = ({ el_val_t _if_result_26 = 0; if (str_contains(cmd, EL_STR("/etc/passwd"))) { _if_result_26 = (30); } else { _if_result_26 = (0); } _if_result_26; });
el_val_t s7 = ({ el_val_t _if_result_27 = 0; if (str_contains(cmd, EL_STR("id_rsa"))) { _if_result_27 = (60); } else { _if_result_27 = (0); } _if_result_27; });
el_val_t s8 = ({ el_val_t _if_result_28 = 0; if (str_contains(cmd, EL_STR(".ssh/"))) { _if_result_28 = (50); } else { _if_result_28 = (0); } _if_result_28; });
el_val_t s9 = ({ el_val_t _if_result_29 = 0; if (str_contains(cmd, EL_STR("crontab"))) { _if_result_29 = (30); } else { _if_result_29 = (0); } _if_result_29; });
el_val_t s10 = ({ el_val_t _if_result_30 = 0; if (str_contains(cmd, EL_STR("LaunchDaemon"))) { _if_result_30 = (40); } else { _if_result_30 = (0); } _if_result_30; });
el_val_t s11 = ({ el_val_t _if_result_31 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("bash")))) { _if_result_31 = (75); } else { _if_result_31 = (0); } _if_result_31; });
el_val_t s12 = ({ el_val_t _if_result_32 = 0; if ((str_contains(cmd, EL_STR("wget")) && str_contains(cmd, EL_STR("bash")))) { _if_result_32 = (75); } else { _if_result_32 = (0); } _if_result_32; });
el_val_t s13 = ({ el_val_t _if_result_33 = 0; if ((str_contains(cmd, EL_STR("curl")) && str_contains(cmd, EL_STR("| sh")))) { _if_result_33 = (60); } else { _if_result_33 = (0); } _if_result_33; });
el_val_t s14 = ({ el_val_t _if_result_34 = 0; if ((str_contains(cmd, EL_STR("base64")) && str_contains(cmd, EL_STR("curl")))) { _if_result_34 = (50); } else { _if_result_34 = (0); } _if_result_34; });
el_val_t s15 = ({ el_val_t _if_result_35 = 0; if (str_contains(cmd, EL_STR("mkfifo"))) { _if_result_35 = (50); } else { _if_result_35 = (0); } _if_result_35; });
el_val_t s16 = ({ el_val_t _if_result_36 = 0; if (str_contains(cmd, EL_STR("chmod +s"))) { _if_result_36 = (70); } else { _if_result_36 = (0); } _if_result_36; });
el_val_t s17 = ({ el_val_t _if_result_37 = 0; if (str_contains(cmd, EL_STR("chmod 4755"))) { _if_result_37 = (70); } else { _if_result_37 = (0); } _if_result_37; });
return ((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17);
return 0;
}
el_val_t threat_score_path(el_val_t path) {
el_val_t s1 = ({ el_val_t _if_result_28 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_28 = (60); } else { _if_result_28 = (0); } _if_result_28; });
el_val_t s2 = ({ el_val_t _if_result_29 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_29 = (70); } else { _if_result_29 = (0); } _if_result_29; });
el_val_t s3 = ({ el_val_t _if_result_30 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_30 = (80); } else { _if_result_30 = (0); } _if_result_30; });
el_val_t s4 = ({ el_val_t _if_result_31 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_31 = (40); } else { _if_result_31 = (0); } _if_result_31; });
el_val_t s5 = ({ el_val_t _if_result_32 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_32 = (60); } else { _if_result_32 = (0); } _if_result_32; });
el_val_t s6 = ({ el_val_t _if_result_33 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_33 = (35); } else { _if_result_33 = (0); } _if_result_33; });
el_val_t s7 = ({ el_val_t _if_result_34 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_34 = (35); } else { _if_result_34 = (0); } _if_result_34; });
el_val_t s8 = ({ el_val_t _if_result_35 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_35 = (35); } else { _if_result_35 = (0); } _if_result_35; });
el_val_t s9 = ({ el_val_t _if_result_36 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_36 = (50); } else { _if_result_36 = (0); } _if_result_36; });
el_val_t s10 = ({ el_val_t _if_result_37 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_37 = (70); } else { _if_result_37 = (0); } _if_result_37; });
el_val_t s11 = ({ el_val_t _if_result_38 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_38 = (70); } else { _if_result_38 = (0); } _if_result_38; });
el_val_t s1 = ({ el_val_t _if_result_38 = 0; if (str_starts_with(path, EL_STR("/etc/"))) { _if_result_38 = (60); } else { _if_result_38 = (0); } _if_result_38; });
el_val_t s2 = ({ el_val_t _if_result_39 = 0; if (str_contains(path, EL_STR("/.ssh/"))) { _if_result_39 = (70); } else { _if_result_39 = (0); } _if_result_39; });
el_val_t s3 = ({ el_val_t _if_result_40 = 0; if (str_contains(path, EL_STR("/LaunchDaemons/"))) { _if_result_40 = (80); } else { _if_result_40 = (0); } _if_result_40; });
el_val_t s4 = ({ el_val_t _if_result_41 = 0; if (str_contains(path, EL_STR("/LaunchAgents/"))) { _if_result_41 = (40); } else { _if_result_41 = (0); } _if_result_41; });
el_val_t s5 = ({ el_val_t _if_result_42 = 0; if (str_contains(path, EL_STR("/cron"))) { _if_result_42 = (60); } else { _if_result_42 = (0); } _if_result_42; });
el_val_t s6 = ({ el_val_t _if_result_43 = 0; if (str_contains(path, EL_STR("/.bashrc"))) { _if_result_43 = (35); } else { _if_result_43 = (0); } _if_result_43; });
el_val_t s7 = ({ el_val_t _if_result_44 = 0; if (str_contains(path, EL_STR("/.zshrc"))) { _if_result_44 = (35); } else { _if_result_44 = (0); } _if_result_44; });
el_val_t s8 = ({ el_val_t _if_result_45 = 0; if (str_contains(path, EL_STR("/.profile"))) { _if_result_45 = (35); } else { _if_result_45 = (0); } _if_result_45; });
el_val_t s9 = ({ el_val_t _if_result_46 = 0; if (str_starts_with(path, EL_STR("/usr/"))) { _if_result_46 = (50); } else { _if_result_46 = (0); } _if_result_46; });
el_val_t s10 = ({ el_val_t _if_result_47 = 0; if (str_starts_with(path, EL_STR("/bin/"))) { _if_result_47 = (70); } else { _if_result_47 = (0); } _if_result_47; });
el_val_t s11 = ({ el_val_t _if_result_48 = 0; if (str_starts_with(path, EL_STR("/sbin/"))) { _if_result_48 = (70); } else { _if_result_48 = (0); } _if_result_48; });
return ((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11);
return 0;
}
el_val_t threat_score_history(el_val_t history) {
el_val_t s1 = ({ el_val_t _if_result_39 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_39 = (15); } else { _if_result_39 = (0); } _if_result_39; });
el_val_t s2 = ({ el_val_t _if_result_40 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_40 = (10); } else { _if_result_40 = (0); } _if_result_40; });
el_val_t s3 = ({ el_val_t _if_result_41 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_41 = (20); } else { _if_result_41 = (0); } _if_result_41; });
el_val_t s4 = ({ el_val_t _if_result_42 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_42 = (15); } else { _if_result_42 = (0); } _if_result_42; });
el_val_t s5 = ({ el_val_t _if_result_43 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_43 = (15); } else { _if_result_43 = (0); } _if_result_43; });
el_val_t s6 = ({ el_val_t _if_result_44 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_44 = (25); } else { _if_result_44 = (0); } _if_result_44; });
el_val_t s7 = ({ el_val_t _if_result_45 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_45 = (25); } else { _if_result_45 = (0); } _if_result_45; });
el_val_t s8 = ({ el_val_t _if_result_46 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_46 = (40); } else { _if_result_46 = (0); } _if_result_46; });
el_val_t s9 = ({ el_val_t _if_result_47 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_47 = (40); } else { _if_result_47 = (0); } _if_result_47; });
el_val_t s10 = ({ el_val_t _if_result_48 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_48 = (35); } else { _if_result_48 = (0); } _if_result_48; });
el_val_t s11 = ({ el_val_t _if_result_49 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_49 = (45); } else { _if_result_49 = (0); } _if_result_49; });
el_val_t s12 = ({ el_val_t _if_result_50 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_50 = (20); } else { _if_result_50 = (0); } _if_result_50; });
el_val_t s13 = ({ el_val_t _if_result_51 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_51 = (30); } else { _if_result_51 = (0); } _if_result_51; });
el_val_t s14 = ({ el_val_t _if_result_52 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_52 = (40); } else { _if_result_52 = (0); } _if_result_52; });
el_val_t s15 = ({ el_val_t _if_result_53 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_53 = (35); } else { _if_result_53 = (0); } _if_result_53; });
el_val_t s16 = ({ el_val_t _if_result_54 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_54 = (20); } else { _if_result_54 = (0); } _if_result_54; });
el_val_t s17 = ({ el_val_t _if_result_55 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_55 = (45); } else { _if_result_55 = (0); } _if_result_55; });
el_val_t s18 = ({ el_val_t _if_result_56 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_56 = (45); } else { _if_result_56 = (0); } _if_result_56; });
el_val_t s19 = ({ el_val_t _if_result_57 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_57 = (40); } else { _if_result_57 = (0); } _if_result_57; });
el_val_t s20 = ({ el_val_t _if_result_58 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_58 = (15); } else { _if_result_58 = (0); } _if_result_58; });
el_val_t s1 = ({ el_val_t _if_result_49 = 0; if (str_contains(history, EL_STR("port scan"))) { _if_result_49 = (15); } else { _if_result_49 = (0); } _if_result_49; });
el_val_t s2 = ({ el_val_t _if_result_50 = 0; if (str_contains(history, EL_STR("enumerate"))) { _if_result_50 = (10); } else { _if_result_50 = (0); } _if_result_50; });
el_val_t s3 = ({ el_val_t _if_result_51 = 0; if (str_contains(history, EL_STR("exploit"))) { _if_result_51 = (20); } else { _if_result_51 = (0); } _if_result_51; });
el_val_t s4 = ({ el_val_t _if_result_52 = 0; if (str_contains(history, EL_STR("payload"))) { _if_result_52 = (15); } else { _if_result_52 = (0); } _if_result_52; });
el_val_t s5 = ({ el_val_t _if_result_53 = 0; if (str_contains(history, EL_STR("persistence"))) { _if_result_53 = (15); } else { _if_result_53 = (0); } _if_result_53; });
el_val_t s6 = ({ el_val_t _if_result_54 = 0; if (str_contains(history, EL_STR("lateral movement"))) { _if_result_54 = (25); } else { _if_result_54 = (0); } _if_result_54; });
el_val_t s7 = ({ el_val_t _if_result_55 = 0; if (str_contains(history, EL_STR("privilege escalation"))) { _if_result_55 = (25); } else { _if_result_55 = (0); } _if_result_55; });
el_val_t s8 = ({ el_val_t _if_result_56 = 0; if (str_contains(history, EL_STR("reverse shell"))) { _if_result_56 = (40); } else { _if_result_56 = (0); } _if_result_56; });
el_val_t s9 = ({ el_val_t _if_result_57 = 0; if (str_contains(history, EL_STR("bind shell"))) { _if_result_57 = (40); } else { _if_result_57 = (0); } _if_result_57; });
el_val_t s10 = ({ el_val_t _if_result_58 = 0; if (str_contains(history, EL_STR("command and control"))) { _if_result_58 = (35); } else { _if_result_58 = (0); } _if_result_58; });
el_val_t s11 = ({ el_val_t _if_result_59 = 0; if (str_contains(history, EL_STR("self-replicate"))) { _if_result_59 = (45); } else { _if_result_59 = (0); } _if_result_59; });
el_val_t s12 = ({ el_val_t _if_result_60 = 0; if (str_contains(history, EL_STR("propagat"))) { _if_result_60 = (20); } else { _if_result_60 = (0); } _if_result_60; });
el_val_t s13 = ({ el_val_t _if_result_61 = 0; if (str_contains(history, EL_STR("ransomware"))) { _if_result_61 = (30); } else { _if_result_61 = (0); } _if_result_61; });
el_val_t s14 = ({ el_val_t _if_result_62 = 0; if (str_contains(history, EL_STR("encrypt files"))) { _if_result_62 = (40); } else { _if_result_62 = (0); } _if_result_62; });
el_val_t s15 = ({ el_val_t _if_result_63 = 0; if (str_contains(history, EL_STR("exfiltrat"))) { _if_result_63 = (35); } else { _if_result_63 = (0); } _if_result_63; });
el_val_t s16 = ({ el_val_t _if_result_64 = 0; if (str_contains(history, EL_STR("zero-day"))) { _if_result_64 = (20); } else { _if_result_64 = (0); } _if_result_64; });
el_val_t s17 = ({ el_val_t _if_result_65 = 0; if (str_contains(history, EL_STR("rootkit"))) { _if_result_65 = (45); } else { _if_result_65 = (0); } _if_result_65; });
el_val_t s18 = ({ el_val_t _if_result_66 = 0; if (str_contains(history, EL_STR("keylogger"))) { _if_result_66 = (45); } else { _if_result_66 = (0); } _if_result_66; });
el_val_t s19 = ({ el_val_t _if_result_67 = 0; if (str_contains(history, EL_STR("botnet"))) { _if_result_67 = (40); } else { _if_result_67 = (0); } _if_result_67; });
el_val_t s20 = ({ el_val_t _if_result_68 = 0; if (str_contains(history, EL_STR("malware"))) { _if_result_68 = (15); } else { _if_result_68 = (0); } _if_result_68; });
return (((((((((((((((((((s1 + s2) + s3) + s4) + s5) + s6) + s7) + s8) + s9) + s10) + s11) + s12) + s13) + s14) + s15) + s16) + s17) + s18) + s19) + s20);
return 0;
}
el_val_t threat_trajectory_check(el_val_t tool_name, el_val_t tool_input) {
el_val_t history = state_get(EL_STR("agentic_conv_history"));
el_val_t computed_tool_score = ({ el_val_t _if_result_59 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_59 = (threat_score_command(cmd)); } else { _if_result_59 = (({ el_val_t _if_result_60 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_60 = (threat_score_path(path)); } else { _if_result_60 = (0); } _if_result_60; })); } _if_result_59; });
el_val_t computed_tool_score = ({ el_val_t _if_result_69 = 0; if (str_eq(tool_name, EL_STR("run_command"))) { el_val_t cmd = json_get(tool_input, EL_STR("command")); _if_result_69 = (threat_score_command(cmd)); } else { _if_result_69 = (({ el_val_t _if_result_70 = 0; if ((str_eq(tool_name, EL_STR("write_file")) || str_eq(tool_name, EL_STR("edit_file")))) { el_val_t path = json_get(tool_input, EL_STR("path")); _if_result_70 = (threat_score_path(path)); } else { _if_result_70 = (0); } _if_result_70; })); } _if_result_69; });
el_val_t history_score = threat_score_history(history);
el_val_t history_contrib = (history_score / 3);
el_val_t combined = (computed_tool_score + history_contrib);
el_val_t should_log = (combined >= 40);
if (should_log) {
el_val_t ts = time_now();
el_val_t authorized_str = ({ el_val_t _if_result_61 = 0; if (security_research_authorized()) { _if_result_61 = (EL_STR("true")); } else { _if_result_61 = (EL_STR("false")); } _if_result_61; });
el_val_t authorized_str = ({ el_val_t _if_result_71 = 0; if (security_research_authorized()) { _if_result_71 = (EL_STR("true")); } else { _if_result_71 = (EL_STR("false")); } _if_result_71; });
el_val_t log_content = el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(el_str_concat(EL_STR("{\"event\":\"threat_check\",\"tool\":\""), tool_name), EL_STR("\",\"score\":")), int_to_str(combined)), EL_STR(",\"tool_score\":")), int_to_str(computed_tool_score)), EL_STR(",\"history_score\":")), int_to_str(history_score)), EL_STR(",\"authorized\":")), authorized_str), EL_STR(",\"ts\":")), int_to_str(ts)), EL_STR("}"));
el_val_t log_tags = EL_STR("[\"security-audit\",\"threat-check\"]");
el_val_t discard = mem_remember(log_content, log_tags);
@@ -575,7 +609,7 @@ el_val_t threat_history_append(el_val_t text) {
el_val_t safe_text = str_to_lower(text);
el_val_t combined = el_str_concat(el_str_concat(current, EL_STR(" ")), safe_text);
el_val_t len = str_len(combined);
el_val_t trimmed = ({ el_val_t _if_result_62 = 0; if ((len > 2000)) { _if_result_62 = (str_slice(combined, (len - 2000), len)); } else { _if_result_62 = (combined); } _if_result_62; });
el_val_t trimmed = ({ el_val_t _if_result_72 = 0; if ((len > 2000)) { _if_result_72 = (str_slice(combined, (len - 2000), len)); } else { _if_result_72 = (combined); } _if_result_72; });
state_set(EL_STR("agentic_conv_history"), trimmed);
return 0;
}